Knowledge Management

Ingestion of Data in Summary Index

IRHM73
Motivator

Hi, I wonder whether someone may be able to help me please.

I've created a Summary Index and populated it with the following search:

(wso2_wmf(RequestCompleted)) OR (auth_wmf(RequestReceived))
| fields _time request.detail.apiContext detail.responseMessage response.detail.statusCode request.tags.path request.detail.applicationProductionClientId request.tags.X-Request-ID tags.X-Request-ID detail.agentCode
| collect index=summary_dg_dda marker="report=ddatestV2"

The ingestion of the data is working fine and I can see all the events and the fields within the JSON file, but none of the 'fields' are shown as 'explicit' and so I'm unable to extract data using a normal 'stats by' query.

Could someone tell me please where I've gone wrong.

Many thanks and kind regards

Chris

0 Karma
1 Solution

jimodonald
Contributor

Typically you configure a scheduled search to populate a summary index not by using the collect command. Please see the Knowledge Manager Manual for using summary indexing.

https://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Usesummaryindexing

View solution in original post

0 Karma

jimodonald
Contributor

Typically you configure a scheduled search to populate a summary index not by using the collect command. Please see the Knowledge Manager Manual for using summary indexing.

https://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Usesummaryindexing

0 Karma

IRHM73
Motivator

Hi, thank you for coming back to me with this.

I didn't know about using the 'report' command in this way.

Many thanks and kind regards

Chris

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...