Splunk Search

How to store daily aggregate data into another index for historical searches?

ishaanshekhar
Communicator

Dear SPLUNK community,

I have 200 servers and index metrics such as CPU, disk, memory, etc. on a per minute interval.

For space constraints, the retention limit on those indexes is 1 week. However, I wish to do historical search over let's say past 1 year data.

Is it possible to run a search to calculate the avg of those metrics by server daily, and store in another index? By doing this, I could have the retention on this index as 1 year as that would take much less space?

Thank you!

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

What you are describing is called a Summary Index and now that you know the term you will be able to find all you need with a simple web search.

View solution in original post

woodcock
Esteemed Legend

What you are describing is called a Summary Index and now that you know the term you will be able to find all you need with a simple web search.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...