topic index time extracted field in summary index in Getting Data In

index time extracted field in summary index

ips_mandar — Wed, 26 Aug 2020 15:08:16 GMT

Hi,
I have created summary index using collect command and in summary index my actual host, source field gets converted into orig_host, orig_source resp. Now I want to know is there any concept of metadata for summary index like in normal index host,source,_time are default index-time extarcted fields and using host/source the search results become faster since it searches only those bucket containing searched host/source. similarly is there any concept in summary index?
Or in summary index all fields are index-time extracted fields?
Any guidance would be appreciate.

Re: index time extracted field in summary index

gcusello — Wed, 26 Aug 2020 15:44:01 GMT

Hi @ips_mandar,

in summary indexes you can insert the fields you need that you listed in the update search.

There're no predefined rules, you can insert the fields you need.

e.g. if you need to have the eventCode, Account_name and host for each event, you could run a searrch like this:

index=wineventlog | table _time host EventCode Account_name | collect index=my_summary_index

as you can see the fields in the summary index are the ones you inserted in the table command and they are both index-time and search-time extracted fields.

Ciao.

Giuseppe

Re: index time extracted field in summary index

ips_mandar — Wed, 26 Aug 2020 16:43:20 GMT

Thanks @gcusello I already tried using

|table host

but still my actual result host field value is stored in orig_host field and not host field and host field has server name.

I still not understand about meta fields like for general index if I search by specifying host value it will be efficient similarly is there any meta fields for summary index?