Deployment Architecture

How to setup summary index using existing date field in data


Hi -

I have saved search returning events from past one year as below

ReadDate Count
20161101 500
20161102 550
20161228 800
20161229 900

and i have populated this data in to summary index however all this data is indexed with current data instead i want all this data to be indexed based on the ReadDate field. Hence tried setting up _time to ReadDate but results are not successful. Any suggestions how to achieve this please?

Thanks in Advance.

Tags (1)
0 Karma

Revered Legend

Try like this

your current saved search giving field ReadDate, Count
| eval _time=strptime(ReadDate,"%Y%m%d")



Thanks for your reply....

It is working....

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...