https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155472#M31580 <P>Is there a drawback to creating many indexes? Hundreds possibly?</P> Tue, 18 Feb 2014 19:32:51 GMT ssledzie 2014-02-18T19:32:51Z https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155470#M31578 <P>If I'm doing product testing and wanted to store data from test runs, how would you recommend associating events with a test id/test run id?</P> <P>Should I annotate the actual log data with a testid?</P> <P>Should I create a new event type that enumerates every event source for the test run?</P> <P>Is there a better way I'm not thinking of? Advice is appreciated.</P> Tue, 18 Feb 2014 19:21:19 GMT https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155470#M31578 ssledzie 2014-02-18T19:21:19Z https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155471#M31579 <P>I would suggest storing the data in separate index so that it can be removed easily later.</P> Tue, 18 Feb 2014 19:24:44 GMT https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155471#M31579 somesoni2 2014-02-18T19:24:44Z https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155472#M31580 <P>Is there a drawback to creating many indexes? Hundreds possibly?</P> Tue, 18 Feb 2014 19:32:51 GMT https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155472#M31580 ssledzie 2014-02-18T19:32:51Z https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155473#M31581 <P>I am using around 150+ indexes and don't see any issues with it. There benefits like I can handle accessibility on the data more easily as I can define different roles for different indexes</P> Tue, 18 Feb 2014 19:52:23 GMT https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155473#M31581 somesoni2 2014-02-18T19:52:23Z https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155474#M31582 <P>Okay let me think about that. It seems like a feasible solution. Thanks.</P> Tue, 18 Feb 2014 22:35:22 GMT https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155474#M31582 ssledzie 2014-02-18T22:35:22Z https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155475#M31583 <P>Once each test run is complete you can add it with specific identifying information to a single summary index. It is not exactly what a summary index is intended to be used for, but it should work just fine, and you will only have one index that contains all test results with each result essentially tagged with test information. See this doc:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configuresummaryindexes">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configuresummaryindexes</A></P> <P>Once you have transferred the information to the summary index, you can use the delete command on the same search you used to populate the summary to delete the data from the main index. Be sure to read the info on the delete command!</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete">http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete</A></P> Wed, 19 Feb 2014 00:21:27 GMT https://community.splunk.com/t5/Getting-Data-In/Recommendation-for-segregating-data-between-product-test-runs/m-p/155475#M31583 lukejadamec 2014-02-19T00:21:27Z