topic Re: How can we get Indexed Fields on Summary Index which generated from Schedule Search? in Splunk Search

How can we get Indexed Fields on Summary Index which generated from Schedule Search?

manikanthkoti — Wed, 02 Sep 2020 18:58:02 GMT

Hi Everyone,

We have one Schedule which is running on the Index(mulesoft_index ).In this Index all the Fields are act as Indexed Fields .

We are Storing Schedule Search Results into one Summary Index (summaryindex_mt_stats) by enabling Summary Indexing option from that Schedule Search.But the Fields are not acting as Indexed-Fields in the Summary Index.

So How can we create Indexed Fields in Summary Index while indexing from a schedule search ?

We are using data models on the Summary Index.But tstats command is not working on the Data Model because tsidx files does not contain the indexed fields, As summary index does not have the indexed fields.

Can any one please help on this?

Thanks&Regards,

Manikanth

Re: How can we get Indexed Fields on Summary Index which generated from Schedule Search?

Nisha18789 — Wed, 02 Sep 2020 22:19:57 GMT

Hi @manikanthkoti , ideally while writing to summary index whatever fileds appear in the results are the indexed fields. Does your search returns the fields in the result that you are interested to see in summary index?

Re: How can we get Indexed Fields on Summary Index which generated from Schedule Search?

gjanders — Thu, 03 Sep 2020 04:18:10 GMT

@Nisha18789that does not sound correct, summary indexing from what I understand does not create indexed fields by default...

Re: How can we get Indexed Fields on Summary Index which generated from Schedule Search?

gjanders — Thu, 03 Sep 2020 04:22:13 GMT

You might be able to apply props.conf rules via the source::<report name> in props.conf if that helps...

Re: How can we get Indexed Fields on Summary Index which generated from Schedule Search?

manikanthkoti — Thu, 03 Sep 2020 06:10:09 GMT

Hi @gjanders @Nisha18789 Thanks for your Response.

@gjanders Like you said Indexed Fields wont create by default while Summary Indexing.

If we can create with the help of props.conf via the source::<report name> Please help us this setting to link with the Summary Indexing.

We are forward to your response.

Thanks & Regards,

Manikanth

Re: How can we get Indexed Fields on Summary Index which generated from Schedule Search?

manikanthkoti — Thu, 03 Sep 2020 06:25:53 GMT

Hi @gjanders @Nisha18789 Thanks for your Response.

@gjanders Like you said Indexed Fields wont create by default while Summary Indexing.

If we can create with the help of props.conf via the source:: Please help us this setting to link with the Summary Indexing. We are forward to your response.

Thanks & Regards,

Manikanth

Re: How can we get Indexed Fields on Summary Index which generated from Schedule Search?

gjanders — Thu, 03 Sep 2020 20:57:05 GMT

Perhaps the first question is why do you want the indexed fields?

You are going to need to write props/transforms entries to get the indexed fields into the summary index I believe...