I have One primary index which contains 30 days logs, but i want from one year for this purpose i created One more splunk summary index where i can copy One month Data (Jan) ,after one month again one month data (Feb) likewise... So how can i copy one month data from One index to another
Hi @kajalchopade071,
the correct use of summary indexes is to contain elaborated data, so you should create a search that already summarize informations (e.g. stats) or a search that contains only the fields you really needs.
If you want all the events of the original index, the best approach is to modify the retention in the primary index to one year.
Anyway, to put data in a summary index, you have to add, at the end of your scheduled search the following command:
| collect index=your_summary_index
as you can see at https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Collect .
Ciao.
Giuseppe
Hi @kajalchopade071,
the correct use of summary indexes is to contain elaborated data, so you should create a search that already summarize informations (e.g. stats) or a search that contains only the fields you really needs.
If you want all the events of the original index, the best approach is to modify the retention in the primary index to one year.
Anyway, to put data in a summary index, you have to add, at the end of your scheduled search the following command:
| collect index=your_summary_index
as you can see at https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Collect .
Ciao.
Giuseppe
Thank you
Hi @kajalchopade071,
good for you, see next time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉