Switch to latest_run_time

guilhemmarchand · Aug 19, 2020 · 758fa73 · 758fa73
1 parent 9d8acbf
commit 758fa73
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 1 deletion.
diff --git a/trackme/default/macros.conf b/trackme/default/macros.conf
@@ -1579,7 +1579,7 @@ definition = search index=_internal sourcetype=scheduler earliest=-4h latest=now
 | stats avg(run_time) AS avg_run_time, max(run_time) AS max_run_time, latest(run_time) AS latest_run_time, latest(result_count) as last_processed_no_entities by savedsearch_name\
 | foreach avg_run_time max_run_time latest_run_time [ eval <<FIELD>> = round('<<FIELD>>', 2) ]\
 | appendcols [ | inputlookup trackme_data_source_monitoring where data_monitored_state="enabled" | where data_last_time_seen>relative_time(now(), "-24h") | stats count as total_entities ]\
-| eval potential_rate_sec=round(avg_run_time/last_processed_no_entities, 2)\
+| eval potential_rate_sec=round(latest_run_time/last_processed_no_entities, 2)\
 | eval max_accepted_run_time_sec=`trackme_data_sampling_max_allowed_runtime_sec`\
 | eval max_entities_to_process=round(max_accepted_run_time_sec/potential_rate_sec, 0)\
 | table max_entities_to_process\

diff --git a/trackme_1221.tgz b/trackme_1221.tgz