Ingestion of Data in Summary Index

[IRHM73]

Hi, I wonder whether someone may be able to help me please.

I've created a Summary Index and populated it with the following search:

(wso2_wmf(RequestCompleted)) OR (auth_wmf(RequestReceived))
| fields _time request.detail.apiContext detail.responseMessage response.detail.statusCode request.tags.path request.detail.applicationProductionClientId request.tags.X-Request-ID tags.X-Request-ID detail.agentCode
| collect index=summary_dg_dda marker="report=ddatestV2"

The ingestion of the data is working fine and I can see all the events and the fields within the JSON file, but none of the 'fields' are shown as 'explicit' and so I'm unable to extract data using a normal 'stats by' query.

Could someone tell me please where I've gone wrong.

Many thanks and kind regards

Chris

[jimodonald · Accepted solution]

Typically you configure a scheduled search to populate a summary index not by using the collect command. Please see the Knowledge Manager Manual for using summary indexing.

https://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Usesummaryindexing

[IRHM73]

Hi, thank you for coming back to me with this.

I didn't know about using the 'report' command in this way.

Many thanks and kind regards

Chris