Splunk Search

How to combine event and summary indexes into a single search?

timgren
Path Finder

Is it possible to setup a dashboard query that uses the main event index for "today", and summary index for all other times while still using the the default time_picker? 

 

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @timgren,

you can create a search in which there are the time delimiters for each index, something like this:

(index=my_index earliest=@d latest=now) OR (index=my_summary_index)
| ...

Otherwise, you have to use a Data Model.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...