Summary Index does not seem correct

aohls — Mon, 26 Aug 2019 16:49:46 GMT

I have a summary index I am looking to put data in.

| table Name,host,_time, component, operation, userName, responseTimeSeconds | fields - _raw

This is the basis of what I have. When putting it into the summary index I was hoping to have only the fields specified in my table. Instead I am getting things like the following included:

08/26/2019 12:29:59 -0400, search_name=savedReport, search_now=1566837000.000, info_min_time=1566836700.000, info_max_time=1566837000.000, info_search_time=1566837197.992,

Is there any way strip out this information in my index? Will it automatically add it. I used collect with testmode=true and thought that should indicate what my output looks like. Is there a step I am missing or is that what I should expect to have in my data? For awareness what I am trying to do is gather some data we want that will stay around longer than our current setup by stripping out a lot of items in the logging we do not need.

Re: Summary Index does not seem correct

woodcock — Mon, 26 Aug 2019 17:55:33 GMT

That is just the way that it works. If you have spare license, you can always use the Log Event action, but it is not free like Summary Index is.

Re: Summary Index does not seem correct

aohls — Mon, 26 Aug 2019 18:04:21 GMT

@woodcock Thanks for the insight.

topic Summary Index does not seem correct in Knowledge Management

Summary Index does not seem correct

Re: Summary Index does not seem correct

Re: Summary Index does not seem correct