Summary Index - Index time vs Search Time extraction

[namrithadeepak]

Hi,

I have to use a couple of extracted fields in my summary index.

I have the necessary regex.

Do I have to make the changes on the indexers or the search heads? Which one do you suggest?

Thanks!

[woodcock]

If all of your searches on this data should have these fields extracted, then use props.conf like this:

[YourSourceTypeHere]
EXTRACT-SourceTypeFields = ...

If you just need it for this search, then use rex in the search SPL:

https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Rex

[micahkemp]

You probably want to add a stanza in your props.conf (on your search head) that matches the 'source' (which is the name of the savedsearch that created the summary data). The 'sourcetype' of summary indexed data is 'stash' by default, and I believe it is advised not to attempt to change this.

props.conf:

[source::<savedsearch_name>]
EXTRACT-
REPORT-
...

[somesoni2]

You need to add the search time field extractions on the search head(s) where that summary index search is running.

[adonio]

can you elaborate? what is the search that populates the summary index?
i think its best to populate (send data to) summary index with data that is already in a table format / has field-values already defined