topic Re: How do I know the title of my system index in Getting Data In

How do I know the title of my system index

aohls — Thu, 18 Jul 2019 18:29:34 GMT

I have read through the documentation and still feel that I am missing something with creating an index summary. I want to use sistats and have my data setup how I want it to generate the index summary. How would I know what the summary is named or how do I generate an index summary for where my data will get stored. I might have missed a key point but I done see how if I use sistats I know how to reference my data.

Re: How do I know the title of my system index

adonio — Thu, 18 Jul 2019 20:07:01 GMT

a summary index is just like any other index
for creating, setting, and all other purposes

Re: How do I know the title of my system index

aohls — Fri, 19 Jul 2019 12:57:53 GMT

So at the end of the search if I have sistats. How would I then search that index? I might need to read up on indexing more but I am looking to speed searching the data. Using sistats seems that it would allow me to search just that data but I am not sure how I would then search it after. Is it more of a behind the scenes item where my search will simply be faste?

Re: How do I know the title of my system index

adonio — Fri, 19 Jul 2019 13:17:50 GMT

https://docs.splunk.com/Documentation/Splunk/7.3.0/Knowledge/Usesummaryindexing
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/sistats

Re: How do I know the title of my system index

aohls — Fri, 19 Jul 2019 14:44:48 GMT

@adonio thank you. I checked these before and it clicked better this time. Will this persist data also? We have about a 3 month limit. I am creating a manual dataset to persist for a longer timerange. Do indexes keep data longer also or only accelerate reporting?

Re: How do I know the title of my system index

adonio — Fri, 19 Jul 2019 14:56:37 GMT

you can set index to whatever retention period you want
retention is limited by either time or size, whatever comes first

Re: How do I know the title of my system index

aohls — Fri, 19 Jul 2019 15:56:33 GMT

This makes a lot more sense thank you. I think half the confusion has come from me not having the access to create an index.