Knowledge Management

How to summary index data in a saved search scheduled to run every hour to a particular index based on a attribute in a saved search?

Explorer

I have a saved search that returns me the following event data :

Event 1 :
source=TRDF1453, Filed1=TESTDATA, Field2=TESTD1, Field3=TestD3

Event 2 :
source=TRDF1494, Filed1=TESTDATA, Field2=TESTD1, Field3=TestD3

Event 3 :
source=TRDF1453, Filed1=TESTDATA, Field2=TESTD1, Field3=TestD3

In the scenario above summary indexing this saved search should
1. move Event 1 and Event 3 to index gndataTRDFX
2. move Event 2 to index gn
dataTRDFY

I make this decision based on 'source' field. If 'source' matches move them to under one index.

Is there any way I can do this in Splunk?

0 Karma

SplunkTrust
SplunkTrust

Create two summary index searches, one looking for source=TRDF1453 and summary indexing to gndataTRDFX index, other one looking for source=TRDF1494 and summary indexing to gndataTRDFY index.

0 Karma

Explorer

This is the approach I am currently taking .. but Can this be done using one single summary index and dynamically choose the index to summary index?

0 Karma

SplunkTrust
SplunkTrust

I got one untested approach. Update your summary index search like this. Do remember to remove summary index option from saved search as we're doing it using collect command in search.

your current search 
| appendpipe [| where source="TRDF_1453" | collect index="gn_data_TRDF_X" sourcetype="ST You want to use"]
| appendpipe [| where source="TRDF_1494" | collect index="gn_data_TRDF_Y" sourcetype="ST You want to use"]
0 Karma

Explorer

yeup. This works for me.

0 Karma