Knowledge Management

Expire Summary Indexing Information



I am setting up summary indexing for period of 5min, weekly and monthly. Here is how I want it to be implemented.

Every Five minutes a schedule search will run and calculate the results for past 5minutes. After one week I would to expire these results and trigger another search that will search for the whole previous week. An after one month i would like to expire the weekly results and trigger another search for past whole month.

So a user can access 5 min data for the past week and weekly data for the previous week and monthly data before last month.

How will I implement this ?

Thanks in Advance.

Tags (1)
0 Karma

Re: Expire Summary Indexing Information


Create a summary index for each set;

summary5min (Retention policy, 1 week)

summary1week (Retention policy 1 month)

summary1month (Retention policy ??? )

every 5 min scheduled saerch is indexed to summary5min

every week schduled saerch is indexed to summary1week

every month scheduled search is indexed to summary1month

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.