Splunk Enterprise

indexed fields are not creating while events are collected into summary index by using collect command

nagendraDumpala
Engager

Hi,

we configured transform.conf, props.conf and fields.conf file while pushing the events into main index. In that time indexed fields are created and when using tstats command is also working fine.

No we are trying to move the search matched events into summary index from main index by using collect command. In this time our main indexed fields are coming into the summary index but, those fields are not acting as indexed fields in summary index. And when we are try to use tstats on summary index also not working on those fields.

Can you please help us to resolve this problem. What we need is, the collected fields also act as indexed fields in summary index.

Please correct us if we missing something.

 

Thanks & Reguards

Nagendra D

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

For a brief description of how to create index-time fields in your summary index,  see the slide titled "Workaround: Stats -> SI + Index Time -> tstats " at https://conf.splunk.com/files/2017/slides/searching-fast-how-to-start-using-tstats-and-other-acceler...

Also, consider using an accelerated data model as an alternative.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...