Splunk Search

How to save a filtered set of events to a seperate index?

jameshgibson
Path Finder

We have a system that produces several GB of logs per day. Of that there is only maybe a few MB that contains information that is worth searching through in Splunk. What I would like to do is set up a scheduled search that saves just the events we care about to a seperate index to help improve search speeds.

I have been trying to use summary indexing for this but I seem to lose all the _time data that go with the events. Is there anyway just to save the filtered events?

Tags (3)
0 Karma
1 Solution

Ayn
Legend

jameshgibson
Path Finder

I have given it a go but the _time field doesn't get save in the index I specify. It just defaults all the events to the time I started the search. Is there something else I need to do?

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...