Aggregate data from summary index

combinatorics — Mon, 24 Sep 2012 21:25:18 GMT

Every year I get asked questions like "What was the traffic volume like last year at this time?". And every year I had to say we didn't retain logs long enough to know. But, this year we have Splunk. So I want to setup some summary searches to start capturing this information day by day so I can report on it later. I'm going to start with a simple search like this.

index=foo sourcetype=access_combined host=myhost | sistats count by root, status, method, uri_path

My question is this... If I include lots of fields in the "by" clause of sistats, will I later still be able to aggregate them if I don't care to differentiate? For example, if I summarize using the query above, but later don't care about breaking down by uri_path, will I be able to? I don't want to capture months worth of summary events just to find out I can't generate the report I want later on.

(I'm creating some fake summary events for the next few days so I can run some sample reports to see what I can do. I just thought you guys might have a good answer that we could have here for others to refer to later.)

Re: Aggregate data from summary index

Ayn — Tue, 25 Sep 2012 06:10:28 GMT

Yes, you could aggregate it even further later on. When you grab data from the summary index for performing stats on it, just omit the fields you want to split by.

topic Re: Aggregate data from summary index in Knowledge Management

Aggregate data from summary index

Re: Aggregate data from summary index