Knowledge Management

How to create a summary index that runs once in a week and I want only few fields to be populated in the summary index?

Poojitha
Path Finder

Hi All, 

I am trying to create a summary index that runs once in a week and I want only few fields to be populated in the summary Index. 

Questions :

1) I want only three fields in Summary Index - Test1 , Test2, Test3.
             Can I use table command on these 3 fields  at end of my query and create a report to populate              Summary Index ? If I use fields command, it is not showing the above fields in my  Index ? Why is it ? 
I want these fields to be in SI so that I can run different stats command and make use in my dashboard.

2) Also, I have used timerange of last  7 days  ( to summary index last 7 days data) but only first 3 days data is being written to SI ? I dont see any errors ? I googled this question but I am not getting exact answer, Can anyone please help me to understand this please. 


Thanks in Advance.
Newbie to Splunk


Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Poojitha,

in Summary indexes you can use only the output of streaming commands and fields isn't one of them, use table.

In addition I hint to always record in Summary also "_time" to have the timestamp of the events to use in timechart command.

Maybe (I'm not sure but it's difficoult to check) the problem of your missing data is related to this.

Ciao.

Giuseppe

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Poojitha,

in Summary indexes you can use only the output of streaming commands and fields isn't one of them, use table.

In addition I hint to always record in Summary also "_time" to have the timestamp of the events to use in timechart command.

Maybe (I'm not sure but it's difficoult to check) the problem of your missing data is related to this.

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...