Splunk Search

How to combine event and summary indexes into a single search?

timgren
Path Finder

Is it possible to setup a dashboard query that uses the main event index for "today", and summary index for all other times while still using the the default time_picker? 

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @timgren,

you can create a search in which there are the time delimiters for each index, something like this:

(index=my_index earliest=@d latest=now) OR (index=my_summary_index)
| ...

Otherwise, you have to use a Data Model.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...