Knowledge Management
Highlighted

Are the fields created using a summary index "index-time" fields?

Champion

Hi,

I am creating a summary index, and want to makes these fields available via tstats - is that possible?

0 Karma
Highlighted

Re: Are the fields created using a summary index "index-time" fields?

Champion

No they are not index-time fields by default.

You will have to define custom index-field extractions using transforms.conf or props.conf settings in order to achieve that.

I assume you are not using the si- commands to generate the fields and, therefore, likely using another sourcetype other than stash. If you are and you are using the collect command to do this, please note that you are impacting your indexing volume license allocation.

Highlighted

Re: Are the fields created using a summary index "index-time" fields?

Esteemed Legend

It is either/or. If you need tstats then you should use an Accelerated Data Model instead of Summary Index:

http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Acceleratedatamodels

View solution in original post

Highlighted

Re: Are the fields created using a summary index "index-time" fields?

Champion

Thanks!

0 Karma