Knowledge Management

Summary Indexing - include all interresting fields

apgersplunk1
Explorer

The use case I am after is to build a summary index that includes all interesting fields (system TAs and keys from lookups) just like they appear when issuing the search in the search bar. The console searches include all normalized fields from TAs such as the alias of dest_ip->dest as well as my lookup key/val pairs but these fields are not preserved in the summary index.

I am using lookups to sift through very large datasets and the resultant matches are a very very small percentage of the original dataset. This subset, based on identification by the lookups, is what I want to work with. MY_FIELD1 tells me that there was a match then the lookup adds another 20 key/value pairs of context (MY_FIELD2, MY_FIELD3, etc).

Example scheduled search every 15 min:

 MY_FIELD1=* earliest=-30m latest=-15m|fields dest,src,MY_* | collect index=summary

RESULT from search bar - results include MY_* fields, dest, src, etc.

RESULT in index (summary) - includes only host, source, sourcetype, index, linecount, splunk_server, and timestamp. It is missing MY_* fields, dest, src, etc.

In summary - I am trying to build an index of events that include all normalized fields and lookup context such that I can search very quickly through this small subset of data rather than having to repeatedly search by applying lookups against a gigantic dataset. Thanks in advance.

Tags (1)
0 Karma

apgersplunk1
Explorer

Decided to use accelerated data models.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>