topic Re: summary index in Knowledge Management

summary index

Mohsin123 — Wed, 17 Jan 2018 09:13:43 GMT

Hi ,

Is it possible to add a new source to an already existing summary index .

We have one source used for the summary index .

Any new source could be added possibly ??

Re: summary index

elliotproebstel — Wed, 17 Jan 2018 14:38:33 GMT

Yes, a summary index can have many sources. Once an index exists, it is possible to direct many sources into it - this is true for regular indexes and summary indexes.

Re: summary index

Mohsin123 — Thu, 18 Jan 2018 12:56:35 GMT

how to add a new source to the summary index ?

Re: summary index

elliotproebstel — Thu, 18 Jan 2018 14:01:41 GMT

That really depends on your use case. Probably the most common way is to feed into a summary index using saved searches or reports. Here are some good walk-through documents that should help you determine how to approach this:

http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Usesummaryindexing
http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Configuresummaryindexes

Re: summary index

efavreau — Tue, 25 Sep 2018 15:05:34 GMT

@Mohsin123 use the new source in your collect statement. Instead of

| collect index=downloadcount

do this

| collect index=downloadcount source=mynewsource