Knowledge Management

Backfill summary index without original data?

Communicator

We used to have a system that aggregated accounting information from some log files and produced daily summaries. We have about 5 years' worth of this summary data.

Now we'd like to use Splunk to index the accounting logs and to produce daily summaries in a summary index. However, we'd also like to be able to import all our old summary data into the summary index. The fillsummaryindex.py script doesn't help here because the original data is gone. Is there a way to do this?

Tags (3)

Splunk Employee
Splunk Employee

There's nothing special about a "summary index" except that the data it holds is summarized. If you have data that is already summarized you can just stuff it in any index (just create a new one) and use it just like you would any other data (i.e. index=accounting_data | timechart sum(income) by department).

Communicator

My summary index is built with sistats, so I'm not quite sure of what the internal format is like. Is there any description of it?

0 Karma