Recommendation for segregating data between product test runs

[ssledzie]

If I'm doing product testing and wanted to store data from test runs, how would you recommend associating events with a test id/test run id?

Should I annotate the actual log data with a testid?

Should I create a new event type that enumerates every event source for the test run?

Is there a better way I'm not thinking of? Advice is appreciated.

[lukejadamec]

Once each test run is complete you can add it with specific identifying information to a single summary index. It is not exactly what a summary index is intended to be used for, but it should work just fine, and you will only have one index that contains all test results with each result essentially tagged with test information. See this doc:

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configuresummaryindexes

Once you have transferred the information to the summary index, you can use the delete command on the same search you used to populate the summary to delete the data from the main index. Be sure to read the info on the delete command!

http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete

[ssledzie]

Okay let me think about that. It seems like a feasible solution. Thanks.

[somesoni2]

I am using around 150+ indexes and don't see any issues with it. There benefits like I can handle accessibility on the data more easily as I can define different roles for different indexes

[ssledzie]

Is there a drawback to creating many indexes? Hundreds possibly?

[somesoni2]

I would suggest storing the data in separate index so that it can be removed easily later.