Knowledge Management

summary index

Mohsin123
Path Finder

Hi ,

Is it possible to add a new source to an already existing summary index .

We have one source used for the summary index .

Any new source could be added possibly ??

0 Karma
1 Solution

elliotproebstel
Champion

Yes, a summary index can have many sources. Once an index exists, it is possible to direct many sources into it - this is true for regular indexes and summary indexes.

View solution in original post

elliotproebstel
Champion

Yes, a summary index can have many sources. Once an index exists, it is possible to direct many sources into it - this is true for regular indexes and summary indexes.

Mohsin123
Path Finder

how to add a new source to the summary index ?

0 Karma

elliotproebstel
Champion

That really depends on your use case. Probably the most common way is to feed into a summary index using saved searches or reports. Here are some good walk-through documents that should help you determine how to approach this:

http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Usesummaryindexing
http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Configuresummaryindexes

0 Karma

efavreau
Motivator

@Mohsin123 use the new source in your collect statement. Instead of

| collect index=downloadcount

do this

| collect index=downloadcount source=mynewsource
###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...