Getting Data In
Highlighted

Recommendation for segregating data between product test runs

New Member

If I'm doing product testing and wanted to store data from test runs, how would you recommend associating events with a test id/test run id?

Should I annotate the actual log data with a testid?

Should I create a new event type that enumerates every event source for the test run?

Is there a better way I'm not thinking of? Advice is appreciated.

Tags (3)
0 Karma
Highlighted

Re: Recommendation for segregating data between product test runs

SplunkTrust
SplunkTrust

I would suggest storing the data in separate index so that it can be removed easily later.

Highlighted

Re: Recommendation for segregating data between product test runs

New Member

Is there a drawback to creating many indexes? Hundreds possibly?

0 Karma
Highlighted

Re: Recommendation for segregating data between product test runs

SplunkTrust
SplunkTrust

I am using around 150+ indexes and don't see any issues with it. There benefits like I can handle accessibility on the data more easily as I can define different roles for different indexes

0 Karma
Highlighted

Re: Recommendation for segregating data between product test runs

New Member

Okay let me think about that. It seems like a feasible solution. Thanks.

0 Karma
Highlighted

Re: Recommendation for segregating data between product test runs

Super Champion

Once each test run is complete you can add it with specific identifying information to a single summary index. It is not exactly what a summary index is intended to be used for, but it should work just fine, and you will only have one index that contains all test results with each result essentially tagged with test information. See this doc:

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configuresummaryindexes

Once you have transferred the information to the summary index, you can use the delete command on the same search you used to populate the summary to delete the data from the main index. Be sure to read the info on the delete command!

http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete

0 Karma