Splunk index

[kajalchopade071]

How can i populate data from primary index to summary index using collect command. 

By using collect command can we populate the logs from primary to summary index 

[gcusello]

Hi @kajalchopade071,

usually summary indexes are used in three cases:

• to summarize events in a different index, in other words, you save in the summary index the results of a grouping command (e.g. stats or timechart) so, you have the already calculated values,
• to save only some fields and have quicker results in search because the field extarction are already present in the summary index events,
• To save some values of events for a period longer than retention.

In other words: usually in summary indexes you don't store the full events but only elaborated results of a query.

Ciao.

Giuseppe

[ITWhisperer]

Or you can create a report, and use it for summary indexing. Normally, you might put this on a schedule e.g. hourly, but you should make sure that each report does not produce overlapping events with those events already covered by the summary index.