Knowledge Management

How can we search the data which we moved in to summary index?

vikkysplunk
Path Finder

Hello Team,

Recently i have created one report to send the data from _introspection index to summary index using collect command and i am able to see the data in summary index but how can i search the data as per below output from summary index?

SPL command which we used to get the Indexer CPU utilization on one hour span :

index="_introspection" host="xxxx*" component=hostwide
|lookup indexers_lookup host OUTPUT alias
| eval Pct_time=(100-'data.cpu_idle_pct')
|eval Pct_time=round(Pct_time,2)
| timechart span=1h avg(Pct_time) by alias limit=0 usenull=f

SPL command which we used in report to send the above CPU utilization report to Summary index on every one hour base.

index="_introspection" host="xxxx*" component=hostwide earliest=-1h@h latest=@h
| lookup indexers_lookup host OUTPUT alias
| eval cpu_time=round((100-'data.cpu_idle_pct'),2)
| fillnull alias value=NONE
| search alias != "NONE"
| table _time,alias,cpu_time
| rename host as "orig_host" cpu_time as "Percent CPU Busy"
| collect index=summary addtime=true marker="search_name=\"Splunk Indexers CPU Busy Snapshot\"" run_in_preview=false

Note : 1) I have created one cron job to send the report to _intersection index to summary on every one hour basis
2) Cron Expression : */17 */1 * * *
3) Time Range : Last One hour

i am able to see the data after moving the data from intersepection to summary index so please could you some one help me to get the below output from summary index?

index="_introspection" host="xxxx*" component=hostwide
|lookup indexers_lookup host OUTPUT alias
| eval Pct_time=(100-'data.cpu_idle_pct')
|eval Pct_time=round(Pct_time,2)
| timechart span=1h avg(Pct_time) by alias limit=0 usenull=f

Thanks in advance!!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One searches a summary index the same as any other index. index=summary.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...