Deployment Architecture

How to setup summary index using existing date field in data


Hi -

I have saved search returning events from past one year as below

ReadDate Count
20161101 500
20161102 550
20161228 800
20161229 900

and i have populated this data in to summary index however all this data is indexed with current data instead i want all this data to be indexed based on the ReadDate field. Hence tried setting up _time to ReadDate but results are not successful. Any suggestions how to achieve this please?

Thanks in Advance.

Tags (1)
0 Karma

Revered Legend

Try like this

your current saved search giving field ReadDate, Count
| eval _time=strptime(ReadDate,"%Y%m%d")



Thanks for your reply....

It is working....

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...