Knowledge Management

How to create a summary index from the existing raw data to include the 13 fields in the attachment?

Path Finder

Need to create a summary index from the existing raw data to include the 13 fields in the attachment. The index needs to be created every 5 mins, 60 mins, and on a daily basis while being retained for a period of 13 months.

I would like to how to retain this for 13 months and is using stats is a correct method to include fields that i need?

Right now i have created the following savedsearches.conf

[30159_cso_stratus_summaryindex]
action.summary_index = 1
action.summary_index._name = cso_stratus_summary
action.summary_index.report = cso_stratus_summaryindex
alert.digest_mode = True
alert.expires = 4h
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = */5 * * * *
description = summary index for cso stratus
dispatch.earliest_time = -5m
dispatch.latest_time = now
enableSched = 1
realtime_schedule = 0
search = search = index="iiiiiuiiiiiiiii" sourcetype="ssssjjsjsjsjjsjs"  |stats count by xxxx,yyyyy,azzzzzz,ccccc,cccc

[30159_cso_stratus_summaryindex]
action.summary_index = 1
action.summary_index._name = cso_stratus_summary
alert.digest_mode = True
alert.expires = 4h
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = */10 * * * *
description = summary index for cso stratus
dispatch.earliest_time = -10m
dispatch.latest_time = now
enableSched = 1
realtime_schedule = 0
search = index="iiiiiuiiiiiiiii" sourcetype="ssssjjsjsjsjjsjs"  |stats count by xxxx,yyyyy,azzzzzz,ccccc,cccc
0 Karma

Contributor

Hello, deepthi5

You can specify fields to write in summary index using | table command.
About retention period It could be specified in indexes.conf using parameter "frozenTimePeriodInSecs"
frozenTimePeriodInSecs = .

SplunkTrust
SplunkTrust

Yes, use | stats to summarize to the level you want, and |table to eliminate all unnecessary fields.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!