Getting Data In

How to create a summary index for my csv file

JoshuaJohn
Contributor

On a daily basis I have a CSV loaded into splunk. I want to create a summary index so that this CSV will have historical data. Currently this file overwrites itself daily.

I have access to savedsearches.conf

Is there a tutorial for this somewhere, or a template I can follow?

0 Karma

somesoni2
Revered Legend

This should give you details of summary indexing process.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Knowledge/Usesummaryindexing#Set_up_summary_i...

Again, the traditional use for summary indexing is for optimizing searches/reports/dashboards, but it can be used for your use-case. You don't have to use any SI commands, so you can use use the like this (assuming CSV you upload as lookup)

| inputlookup yourUploadeda.csv 
0 Karma

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...