Knowledge Management
Highlighted

Summary Index does not seem correct

Communicator

I have a summary index I am looking to put data in.

| table Name,host,_time, component, operation, userName, responseTimeSeconds
| fields - _raw

This is the basis of what I have. When putting it into the summary index I was hoping to have only the fields specified in my table. Instead I am getting things like the following included:

08/26/2019 12:29:59 -0400, search_name=savedReport, search_now=1566837000.000, info_min_time=1566836700.000, info_max_time=1566837000.000, info_search_time=1566837197.992,

Is there any way strip out this information in my index? Will it automatically add it. I used collect with testmode=true and thought that should indicate what my output looks like. Is there a step I am missing or is that what I should expect to have in my data? For awareness what I am trying to do is gather some data we want that will stay around longer than our current setup by stripping out a lot of items in the logging we do not need.

0 Karma
Highlighted

Re: Summary Index does not seem correct

Esteemed Legend

That is just the way that it works. If you have spare license, you can always use the Log Event action, but it is not free like Summary Index is.

View solution in original post

0 Karma
Highlighted

Re: Summary Index does not seem correct

Communicator

@woodcock Thanks for the insight.

0 Karma