topic Re: Splunk query in Splunk Search

Splunk query

kajalchopade071 — Wed, 02 Feb 2022 10:12:40 GMT

I have One primary index which contains 30 days logs, but i want from one year for this purpose i created One more splunk summary index where i can copy One month Data (Jan) ,after one month again one month data (Feb) likewise... So how can i copy one month data from One index to another

Re: Splunk query

gcusello — Wed, 02 Feb 2022 10:22:44 GMT

Hi @kajalchopade071,

the correct use of summary indexes is to contain elaborated data, so you should create a search that already summarize informations (e.g. stats) or a search that contains only the fields you really needs.

If you want all the events of the original index, the best approach is to modify the retention in the primary index to one year.

Anyway, to put data in a summary index, you have to add, at the end of your scheduled search the following command:

| collect index=your_summary_index

as you can see at https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Collect .

Ciao.

Giuseppe

Re: Splunk query

kajalchopade071 — Wed, 02 Feb 2022 15:25:18 GMT

Thank you

Re: Splunk query

gcusello — Wed, 02 Feb 2022 15:53:17 GMT

Hi @kajalchopade071,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉