Splunk Search

Splunk index

kajalchopade071
Path Finder

How can i populate data from primary index to summary index using collect command. 

By using collect command can we populate the logs from primary to summary index 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kajalchopade071,

usually summary indexes are used in three cases:

  • to summarize events in a different index, in other words, you save in the summary index the results of a grouping command (e.g. stats or timechart) so, you have the already calculated values,
  • to save only some fields and have quicker results in search because the field extarction are already present in the summary index events,
  • To save some values of events for a period longer than retention.

In other words: usually in summary indexes you don't store the full events but only elaborated results of a query.

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Or you can create a report, and use it for summary indexing. Normally, you might put this on a schedule e.g. hourly, but you should make sure that each report does not produce overlapping events with those events already covered by the summary index.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...