We used to have a system that aggregated accounting information from some log files and produced daily summaries. We have about 5 years' worth of this summary data.
Now we'd like to use Splunk to index the accounting logs and to produce daily summaries in a summary index. However, we'd also like to be able to import all our old summary data into the summary index. The fillsummaryindex.py script doesn't help here because the original data is gone. Is there a way to do this?
There's nothing special about a "summary index" except that the data it holds is summarized. If you have data that is already summarized you can just stuff it in any index (just create a new one) and use it just like you would any other data (i.e. index=accounting_data | timechart sum(income) by department).