Apr 13 2022 07:00 PM
Hi all, was looking for some clarification around this but wasn't able to find anything online that could confirm one way or another.
If I want to use the materialize() function to cache 180d worth of data for use in my query, is it possible to use in an Analytics Rule? The 14d lookback limitation is there, and was wondering if materialize() is thus also restricted to 14 days maximum. My gut feel says it is, but some clear clarification on that would be awesome.
Apr 14 2022 04:57 AM
Solution@ReganDangerCarey You are correct in that you *cannot* cache 180days and use it in an Analytic rule. The Analytics rules actually ignore any sort of time reference in the query (i.e. | where TimeGenerated > ago(180d) ) so there is no way to specify you want to look more than 14 days in the past.
Apr 18 2022 11:40 PM