Splunk generally index data based on _time.
We have a use case where we want to retrieve results from summary index based on the batchid field. Can you please let us know what is the best way to achieve that scenario?
Theres not a lot of info here.. So I'm going to take a shot in the dark and say
index=summary batchid=<your_id>
Could you explain more about your requirement here, possibly with few examples?
