Hi,
I have a scheduled search that detects assets when they enter and leave geofences.
For that I calculate things like total time travelled, distance, everage speed and so forth...
The search is pretty long and complicated and runs every 3 minutes and looks back 1 hour for changes.
The detected events are collected into a summary index.
Now comes the problem, that the logic for geofence-detection has changed - which means my summary index has become useless.
Ich made changes to my search according to customer requests and the current detected events are fine.
But everything up to this point has no value.
I made a plan to re-build the time from January 1st to today in a secondary summary index.
But i theory I would set the timewindow manually, as far as I understood.
means:
1. go to search app
2. copy my search into search window
3. set timerange to 01/01/20-00:00:00 --> 01/01/20-01:00:00
4. let the search run
5. set timerange to 01/01/20-00:03:00 --> 01/01/20-01:03:00
6. let the search run
...
1723434. set timerange to 02/27/20-15:00:00 --> 02/27/20-15:03:00
1723435. let the search run
Another way would be to make a JavaScript program in the backend of a Dashboard and let the search run in a loop that artificially sets the timerange.
Is there another way I am not seeing to let an entire search run in timeslots?
The obvious solution would be to re-write the entire search to be compatible with time-window based commands. But i dont see a way to make sure the results would 1:1 the same with changing the entire search.
↧
