Splunk Enterprise

indexed fields are not creating while events are collected into summary index by using collect command

nagendraDumpala
Engager

Hi,

we configured transform.conf, props.conf and fields.conf file while pushing the events into main index. In that time indexed fields are created and when using tstats command is also working fine.

No we are trying to move the search matched events into summary index from main index by using collect command. In this time our main indexed fields are coming into the summary index but, those fields are not acting as indexed fields in summary index. And when we are try to use tstats on summary index also not working on those fields.

Can you please help us to resolve this problem. What we need is, the collected fields also act as indexed fields in summary index.

Please correct us if we missing something.

 

Thanks & Reguards

Nagendra D

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

For a brief description of how to create index-time fields in your summary index,  see the slide titled "Workaround: Stats -> SI + Index Time -> tstats " at https://conf.splunk.com/files/2017/slides/searching-fast-how-to-start-using-tstats-and-other-acceler...

Also, consider using an accelerated data model as an alternative.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...