creating index under the main

[Hindoo]

I want to hold the logs arriving by source

[NOUMSSI]

Hi,
By default, some logs are in index _internal. so you can send logs that you want in another index.
To do that, you must know the source of the logs that you want to send and you must create the index that will receive those logs.
If you have all ready done that, run this search:

index=_internal source=the_source_of_your_logs |collect index=new_index

You can create an alert that will run this search during a given periode

[NOUMSSI]

Hi,

when you create your summary indexing use this search code:

index=_internal source=the_source_of_your_logs |table status log_level ...

[martin_mueller]

Could you elaborate on your actual question?

[stephane_cyrill · Accepted solution]

Hi,
If you know where to find the log or where the logs are stored, you can create a summary index with a well build request that fetch arriving log event by source and place then in a dedicared index that you can create.

To create summary indexing in splunk web(with splunk 6.2) go to Setting--->Search,alert,report--->add new.

[Hindoo]

Hello
Thanks a lot. It helped me..
But what we wrote in the search and search name fields

[martin_mueller]

What are you actually trying to do?