https://community.splunk.com/t5/Getting-Data-In/summarize-events-to-new-event/m-p/45277#M8477 <P>A combination of <CODE>transaction</CODE> (<A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction</A> ) and summary indexing (<A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing</A> ) might perhaps be what you're looking for?</P> Tue, 28 Aug 2012 09:35:05 GMT Ayn 2012-08-28T09:35:05Z https://community.splunk.com/t5/Getting-Data-In/summarize-events-to-new-event/m-p/45276#M8476 <P>Hello out there!</P> <P>I dont know if i am doing something wrong. So maybe somebody could help me with this question.</P> <P>I index a few events. I can do some searches on them, but the events "expire" (kind of). So when the last part of the event is appearing, sth like "event_id=2846 status=finished" i 'd like to summarize all the events matching the event_id=2846 and create a new event. i d'like to do this for statistics so i need just some of the original values. furthermore these events should be saved in a different index, so they should be keeped longer.</P> <P>Is there any possibility to do this? Is there a Splunk-way, which satisfies my problem much better?</P> <P>Thanks a lot!</P> Mon, 28 Sep 2020 12:20:44 GMT https://community.splunk.com/t5/Getting-Data-In/summarize-events-to-new-event/m-p/45276#M8476 flanghof 2020-09-28T12:20:44Z https://community.splunk.com/t5/Getting-Data-In/summarize-events-to-new-event/m-p/45277#M8477 <P>A combination of <CODE>transaction</CODE> (<A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction</A> ) and summary indexing (<A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing</A> ) might perhaps be what you're looking for?</P> Tue, 28 Aug 2012 09:35:05 GMT https://community.splunk.com/t5/Getting-Data-In/summarize-events-to-new-event/m-p/45277#M8477 Ayn 2012-08-28T09:35:05Z