Getting Data In

How to create a summary index for my csv file

JoshuaJohn
Contributor

On a daily basis I have a CSV loaded into splunk. I want to create a summary index so that this CSV will have historical data. Currently this file overwrites itself daily.

I have access to savedsearches.conf

Is there a tutorial for this somewhere, or a template I can follow?

0 Karma

somesoni2
Revered Legend

This should give you details of summary indexing process.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Knowledge/Usesummaryindexing#Set_up_summary_i...

Again, the traditional use for summary indexing is for optimizing searches/reports/dashboards, but it can be used for your use-case. You don't have to use any SI commands, so you can use use the like this (assuming CSV you upload as lookup)

| inputlookup yourUploadeda.csv 
0 Karma

adonio
Ultra Champion
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...

Federated Search for CloudWatch Unified Data Store Is Generally Available

As organizations modernize their cloud environments, AWS workloads generate more security, operational, and ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...