Splunk Search

Can you help me with summary index field issue?

chinmayc469
Explorer

Hello,

I have created a scheduled search which populates a summary index from a custom index.

My main custom index has around 100 fields, but those fields are not appearing in the summary index. Only host and source source type fields are present in the summary index.

When i tried adding table field1, field2, etc in the scheduled search query, then those mentioned fields were appearing in the summary index. But when i use table * in the search query, i am not getting any fields in the summary index.

Currently, I have to explicitly specify "table field names" in the query, which is tedious considering the number of fields.

IS there any way to fix this issue?

0 Karma

landen99
Motivator

In the first place, you should be creating summary data for the summary index. Re-indexing a shorter version of all or even a filtered subset is extremely redundant, unnecessary and not the purpose of a summary index.
All that said, | table * includes many metadata fields that should not be included in a summary index including all the "_" fields. Given that you have said the number of fields is quite large, it is hard to imagine a case where such belongs in a summary index. But if you must, you may want to try adding a | fields - _* to remove the underscore fields and a few others like sourcetype, host, source, index, etc.
Also, ensure that your search head is forwarding to the IDX tier so that you take advantage of the parallelization. Also, make sure that you are using collect instead of tscollect.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...