Knowledge Management

Expire Summary Indexing Information

KarunK
Contributor

Hi,

I am setting up summary indexing for period of 5min, weekly and monthly. Here is how I want it to be implemented.

Every Five minutes a schedule search will run and calculate the results for past 5minutes. After one week I would to expire these results and trigger another search that will search for the whole previous week. An after one month i would like to expire the weekly results and trigger another search for past whole month.

So a user can access 5 min data for the past week and weekly data for the previous week and monthly data before last month.

How will I implement this ?

Thanks in Advance.

Tags (1)
0 Karma

Masa
Splunk Employee
Splunk Employee

Create a summary index for each set;

summary5min (Retention policy, 1 week)

summary1week (Retention policy 1 month)

summary1month (Retention policy ??? )

every 5 min scheduled saerch is indexed to summary5min

every week schduled saerch is indexed to summary1week

every month scheduled search is indexed to summary1month

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...

From GPU to Application: Monitoring Cisco AI Infrastructure with Splunk Observability ...

AI workloads are different. They demand specialized infrastructure—powerful GPUs, enterprise-grade networking, ...

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...