topic Splunk index in Splunk Search

Splunk index

kajalchopade071 — Thu, 03 Feb 2022 10:58:36 GMT

How can i populate data from primary index to summary index using collect command.

By using collect command can we populate the logs from primary to summary index

Re: Splunk index

ITWhisperer — Thu, 03 Feb 2022 11:17:49 GMT

Or you can create a report, and use it for summary indexing. Normally, you might put this on a schedule e.g. hourly, but you should make sure that each report does not produce overlapping events with those events already covered by the summary index.

Re: Splunk index

gcusello — Thu, 03 Feb 2022 11:52:30 GMT

Hi @kajalchopade071,

usually summary indexes are used in three cases:

to summarize events in a different index, in other words, you save in the summary index the results of a grouping command (e.g. stats or timechart) so, you have the already calculated values,
to save only some fields and have quicker results in search because the field extarction are already present in the summary index events,
To save some values of events for a period longer than retention.

In other words: usually in summary indexes you don't store the full events but only elaborated results of a query.

Ciao.

Giuseppe