Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- summary index
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi ,
Is it possible to add a new source to an already existing summary index .
We have one source used for the summary index .
Any new source could be added possibly ??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, a summary index can have many sources. Once an index exists, it is possible to direct many sources into it - this is true for regular indexes and summary indexes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, a summary index can have many sources. Once an index exists, it is possible to direct many sources into it - this is true for regular indexes and summary indexes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how to add a new source to the summary index ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That really depends on your use case. Probably the most common way is to feed into a summary index using saved searches or reports. Here are some good walk-through documents that should help you determine how to approach this:
http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Usesummaryindexing
http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Configuresummaryindexes
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Mohsin123 use the new source in your collect statement. Instead of
| collect index=downloadcount
do this
| collect index=downloadcount source=mynewsource
If this reply helps you, an upvote would be appreciated.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
