<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Expire Summary Indexing Information in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Expire-Summary-Indexing-Information/m-p/87395#M900</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I am setting up summary indexing for period of 5min, weekly and monthly. Here is how I want it to be implemented.&lt;/P&gt;

&lt;P&gt;Every Five minutes a schedule search will run and calculate the results for past 5minutes. After one week I would to expire these results and trigger another search that will search for the whole previous week. An after one month i would like to expire the weekly results and trigger another search for past whole month.&lt;/P&gt;

&lt;P&gt;So a user can access 5 min data for the past week and weekly data for the previous week and monthly data before last month.&lt;/P&gt;

&lt;P&gt;How will I implement this ?&lt;/P&gt;

&lt;P&gt;Thanks in Advance.&lt;/P&gt;</description>
    <pubDate>Thu, 08 Mar 2012 04:49:08 GMT</pubDate>
    <dc:creator>KarunK</dc:creator>
    <dc:date>2012-03-08T04:49:08Z</dc:date>
    <item>
      <title>Expire Summary Indexing Information</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Expire-Summary-Indexing-Information/m-p/87395#M900</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I am setting up summary indexing for period of 5min, weekly and monthly. Here is how I want it to be implemented.&lt;/P&gt;

&lt;P&gt;Every Five minutes a schedule search will run and calculate the results for past 5minutes. After one week I would to expire these results and trigger another search that will search for the whole previous week. An after one month i would like to expire the weekly results and trigger another search for past whole month.&lt;/P&gt;

&lt;P&gt;So a user can access 5 min data for the past week and weekly data for the previous week and monthly data before last month.&lt;/P&gt;

&lt;P&gt;How will I implement this ?&lt;/P&gt;

&lt;P&gt;Thanks in Advance.&lt;/P&gt;</description>
      <pubDate>Thu, 08 Mar 2012 04:49:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Expire-Summary-Indexing-Information/m-p/87395#M900</guid>
      <dc:creator>KarunK</dc:creator>
      <dc:date>2012-03-08T04:49:08Z</dc:date>
    </item>
    <item>
      <title>Re: Expire Summary Indexing Information</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Expire-Summary-Indexing-Information/m-p/87396#M901</link>
      <description>&lt;P&gt;Create a summary index for each set;&lt;BR /&gt;&lt;BR /&gt;
summary5min (Retention policy, 1 week)&lt;BR /&gt;&lt;BR /&gt;
summary1week (Retention policy 1 month)&lt;BR /&gt;&lt;BR /&gt;
summary1month (Retention policy ??? )&lt;BR /&gt;&lt;/P&gt;

&lt;P&gt;every 5 min scheduled saerch is indexed to summary5min&lt;BR /&gt;&lt;BR /&gt;
every week schduled saerch is indexed to summary1week&lt;BR /&gt;&lt;BR /&gt;
every month scheduled search is indexed to summary1month&lt;BR /&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 08 Mar 2012 05:25:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Expire-Summary-Indexing-Information/m-p/87396#M901</guid>
      <dc:creator>Masa</dc:creator>
      <dc:date>2012-03-08T05:25:41Z</dc:date>
    </item>
  </channel>
</rss>

