topic Re: Summary Index - Index time vs Search Time extraction in Deployment Architecture

Summary Index - Index time vs Search Time extraction

namrithadeepak — Thu, 25 May 2017 14:00:20 GMT

Hi,

I have to use a couple of extracted fields in my summary index.

I have the necessary regex.

Do I have to make the changes on the indexers or the search heads? Which one do you suggest?

Thanks!

Re: Summary Index - Index time vs Search Time extraction

adonio — Thu, 25 May 2017 14:45:08 GMT

can you elaborate? what is the search that populates the summary index?
i think its best to populate (send data to) summary index with data that is already in a table format / has field-values already defined

Re: Summary Index - Index time vs Search Time extraction

somesoni2 — Thu, 25 May 2017 14:50:00 GMT

You need to add the search time field extractions on the search head(s) where that summary index search is running.

Re: Summary Index - Index time vs Search Time extraction

micahkemp — Thu, 25 May 2017 18:01:56 GMT

You probably want to add a stanza in your props.conf (on your search head) that matches the 'source' (which is the name of the savedsearch that created the summary data). The 'sourcetype' of summary indexed data is 'stash' by default, and I believe it is advised not to attempt to change this.

props.conf:

[source::<savedsearch_name>]
EXTRACT-
REPORT-
...

Re: Summary Index - Index time vs Search Time extraction

woodcock — Thu, 25 May 2017 19:48:09 GMT

If all of your searches on this data should have these fields extracted, then use props.conf like this:

[YourSourceTypeHere]
EXTRACT-SourceTypeFields = ...

If you just need it for this search, then use rex in the search SPL:

https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Rex