topic Re: Creating Summary Index based on logic in Splunk Cloud Platform

Creating Summary Index based on logic

Kirthika — Fri, 16 Jun 2023 17:53:14 GMT

I have 3 panels. Each panels have the same query except 2nd line which contains patterns.

Eg. index="index_name" source="input.txt"

some regex pattern line ( only this line will be different in all three panels)

table id Action

All remaining lines will be same in all three panels.

How to create one summary index and implement as base search for all three panels

Re: Creating Summary Index based on logic

ITWhisperer — Fri, 16 Jun 2023 18:30:46 GMT

Why do you want a summary index, just use a base search?

Re: Creating Summary Index based on logic

Kirthika — Fri, 16 Jun 2023 18:32:20 GMT

Thanks. But didn't get idea how to implement base search when only second line changes

Re: Creating Summary Index based on logic

VatsalJagani — Fri, 16 Jun 2023 18:34:45 GMT

@Kirthika - Few questions:

Why do you need a summary index?
Are you looking to do this for the dashboard, right?
You need to explain the second line, and what it has in order to give you some suggestion.
- Like, regex is _raw based, or any specific field.
Maybe give your existing searches to understand more. (You can mask the critical values before copy-pasting on the community.)

Re: Creating Summary Index based on logic

ITWhisperer — Fri, 16 Jun 2023 18:36:54 GMT

Your base search would have the first line. Your panel searches would have the second lines followed by the common lines. You could put these in a macro if you want them all to use the same code.