On a daily basis I have a CSV loaded into splunk. I want to create a summary index so that this CSV will have historical data. Currently this file overwrites itself daily.
I have access to savedsearches.conf
Is there a tutorial for this somewhere, or a template I can follow?
This should give you details of summary indexing process.
Again, the traditional use for summary indexing is for optimizing searches/reports/dashboards, but it can be used for your use-case. You don't have to use any SI commands, so you can use use the like this (assuming CSV you upload as lookup)
| inputlookup yourUploadeda.csv
let us know if further help is needed