Knowledge Management

How to summary index data in a saved search scheduled to run every hour to a particular index based on a attribute in a saved search?

rmuraly
Explorer

I have a saved search that returns me the following event data :

Event 1 :
source=TRDF_1453, Filed1=TEST_DATA, Field2=TEST_D1, Field3=Test_D3

Event 2 :
source=TRDF_1494, Filed1=TEST_DATA, Field2=TEST_D1, Field3=Test_D3

Event 3 :
source=TRDF_1453, Filed1=TEST_DATA, Field2=TEST_D1, Field3=Test_D3

In the scenario above summary indexing this saved search should
1. move Event 1 and Event 3 to index gn_data_TRDF_X
2. move Event 2 to index gn_data_TRDF_Y

I make this decision based on 'source' field. If 'source' matches move them to under one index.

Is there any way I can do this in Splunk?

0 Karma

somesoni2
Revered Legend

Create two summary index searches, one looking for source=TRDF_1453 and summary indexing to gn_data_TRDF_X index, other one looking for source=TRDF_1494 and summary indexing to gn_data_TRDF_Y index.

0 Karma

rmuraly
Explorer

This is the approach I am currently taking .. but Can this be done using one single summary index and dynamically choose the index to summary index?

0 Karma

somesoni2
Revered Legend

I got one untested approach. Update your summary index search like this. Do remember to remove summary index option from saved search as we're doing it using collect command in search.

your current search 
| appendpipe [| where source="TRDF_1453" | collect index="gn_data_TRDF_X" sourcetype="ST You want to use"]
| appendpipe [| where source="TRDF_1494" | collect index="gn_data_TRDF_Y" sourcetype="ST You want to use"]
0 Karma

rmuraly
Explorer

yeup. This works for me.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...