Can we populate the raw events from one index to summary index. If yes how can I do that can you please help me
Hi @kajalchopade071,
if you search, few days ago there was the same question.
Anyway, the only reasons to do this are:
for this reasons, why do you want to pass _row data from an index to a summary?
Anyway, you could do this (but I don't hint it) running a search and saving results in a summary using the collect command (https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Collect).
Ciao.
Giuseppe
Hi @kajalchopade071,
if you search, few days ago there was the same question.
Anyway, the only reasons to do this are:
for this reasons, why do you want to pass _row data from an index to a summary?
Anyway, you could do this (but I don't hint it) running a search and saving results in a summary using the collect command (https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Collect).
Ciao.
Giuseppe
Hi @kajalchopade071,
good for you, see next time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉