Knowledge Management

Aggregate data from summary index

combinatorics
Explorer

Every year I get asked questions like "What was the traffic volume like last year at this time?". And every year I had to say we didn't retain logs long enough to know. But, this year we have Splunk. So I want to setup some summary searches to start capturing this information day by day so I can report on it later. I'm going to start with a simple search like this.

index=foo sourcetype=access_combined host=myhost | sistats count by root, status, method, uri_path

My question is this... If I include lots of fields in the "by" clause of sistats, will I later still be able to aggregate them if I don't care to differentiate? For example, if I summarize using the query above, but later don't care about breaking down by uri_path, will I be able to? I don't want to capture months worth of summary events just to find out I can't generate the report I want later on.

(I'm creating some fake summary events for the next few days so I can run some sample reports to see what I can do. I just thought you guys might have a good answer that we could have here for others to refer to later.)

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Yes, you could aggregate it even further later on. When you grab data from the summary index for performing stats on it, just omit the fields you want to split by.

View solution in original post

Ayn
Legend

Yes, you could aggregate it even further later on. When you grab data from the summary index for performing stats on it, just omit the fields you want to split by.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...