Getting Data In

index time extracted field in summary index

ips_mandar
Builder

Hi,
I have created summary index using collect command and in summary index my actual host, source field gets converted into orig_host, orig_source resp. Now I want to know is there any concept of metadata for summary index like in normal index host,source,_time are default index-time extarcted fields and using host/source the search results become faster since it searches only those bucket containing searched host/source. similarly is there any concept in summary index?
Or in summary index all fields are index-time extracted fields?
Any guidance would be appreciate.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ips_mandar,

in summary indexes you can insert the fields you need that you listed in the update search.

There're no predefined rules, you can insert the fields you need.

e.g. if you need to have the eventCode, Account_name and host for each event, you could run a searrch like this:

index=wineventlog
| table _time host EventCode Account_name
| collect index=my_summary_index

as you can see the fields in the summary index are the ones you inserted in the  table command and they are both index-time and search-time extracted fields.

Ciao.

Giuseppe

0 Karma

ips_mandar
Builder

Thanks @gcusello  I already tried using 

 

|table host

 

but still my actual result host field value is stored in orig_host field and not host field and host field has server name.

I still not understand about meta fields like for general index if I search by specifying host value it will be efficient similarly is there any meta fields for summary index?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...