How to create a summary index that runs once in a week and I want only few fields to be populated in the summary index?

[Poojitha]

Hi All, 

I am trying to create a summary index that runs once in a week and I want only few fields to be populated in the summary Index. 

Questions :

1) I want only three fields in Summary Index - Test1 , Test2, Test3.
             Can I use table command on these 3 fields  at end of my query and create a report to populate              Summary Index ? If I use fields command, it is not showing the above fields in my  Index ? Why is it ? 
I want these fields to be in SI so that I can run different stats command and make use in my dashboard.

2) Also, I have used timerange of last  7 days  ( to summary index last 7 days data) but only first 3 days data is being written to SI ? I dont see any errors ? I googled this question but I am not getting exact answer, Can anyone please help me to understand this please. 


Thanks in Advance.
Newbie to Splunk

[gcusello · Accepted solution]

Hi @Poojitha,

in Summary indexes you can use only the output of streaming commands and fields isn't one of them, use table.

In addition I hint to always record in Summary also "_time" to have the timestamp of the events to use in timechart command.

Maybe (I'm not sure but it's difficoult to check) the problem of your missing data is related to this.

Ciao.

Giuseppe