Archive

Sumary index not extracting fields as in source index

Path Finder

Hi team,

I want to copy complete data to summary just because it has longer retention period in my environment. I am not doing any stats on data. Below command works fine and I can see the data as per scheduled report. However when I look at the data in summary index, the fields are not extrated as it is in source index.

I serached and feel that writing transforms is the only way to extract fields in summary index. Can some one confirm.

index=index123 source=test.csv sourcetype=new | collect index=index123_summary source=test.csv sourcetype=new

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

As a general case, yes.

If you haven't specified the fields to save to the summary index, then probably you are saving _raw and a few other fields, and you are going to have to specify, for the system, all the extractions that it has already been told how to do on the old data. Presumably, most of those are related to the old sourcetype, so you should be able to clone the old sourcetype stanzas to the new ones, without having to replicate the transforms themselves.

This attempt should be subjected to extensive testing in your test/dev/qa environment if you have one.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

As a general case, yes.

If you haven't specified the fields to save to the summary index, then probably you are saving _raw and a few other fields, and you are going to have to specify, for the system, all the extractions that it has already been told how to do on the old data. Presumably, most of those are related to the old sourcetype, so you should be able to clone the old sourcetype stanzas to the new ones, without having to replicate the transforms themselves.

This attempt should be subjected to extensive testing in your test/dev/qa environment if you have one.

View solution in original post

0 Karma

Path Finder

Thank you.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!