Knowledge Management

How to create a summary index that runs once in a week and I want only few fields to be populated in the summary index?

Poojitha
Path Finder

Hi All, 

I am trying to create a summary index that runs once in a week and I want only few fields to be populated in the summary Index. 

Questions :

1) I want only three fields in Summary Index - Test1 , Test2, Test3.
             Can I use table command on these 3 fields  at end of my query and create a report to populate              Summary Index ? If I use fields command, it is not showing the above fields in my  Index ? Why is it ? 
I want these fields to be in SI so that I can run different stats command and make use in my dashboard.

2) Also, I have used timerange of last  7 days  ( to summary index last 7 days data) but only first 3 days data is being written to SI ? I dont see any errors ? I googled this question but I am not getting exact answer, Can anyone please help me to understand this please. 


Thanks in Advance.
Newbie to Splunk


Labels (1)
0 Karma
1 Solution

gcusello
Legend

Hi @Poojitha,

in Summary indexes you can use only the output of streaming commands and fields isn't one of them, use table.

In addition I hint to always record in Summary also "_time" to have the timestamp of the events to use in timechart command.

Maybe (I'm not sure but it's difficoult to check) the problem of your missing data is related to this.

Ciao.

Giuseppe

 

View solution in original post

gcusello
Legend

Hi @Poojitha,

in Summary indexes you can use only the output of streaming commands and fields isn't one of them, use table.

In addition I hint to always record in Summary also "_time" to have the timestamp of the events to use in timechart command.

Maybe (I'm not sure but it's difficoult to check) the problem of your missing data is related to this.

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...