Splunk Search

Splunk query

kajalchopade071
Path Finder

I have One primary index which contains 30 days logs, but i want from one year for this purpose i created One more splunk summary index where i can copy One month Data (Jan) ,after one month again one month data (Feb) likewise... So how can i copy one month data from One index to another 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kajalchopade071,

the correct use of summary indexes is to contain elaborated data, so you should create a search that already summarize informations (e.g. stats) or a search that contains only the fields you really needs.

If you want all the events of the original index, the best approach is to modify the retention in the primary index to one year.

Anyway, to put data in a summary index, you have to add, at the end of your scheduled search the following command:

| collect index=your_summary_index

as you can see at https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Collect .

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kajalchopade071,

the correct use of summary indexes is to contain elaborated data, so you should create a search that already summarize informations (e.g. stats) or a search that contains only the fields you really needs.

If you want all the events of the original index, the best approach is to modify the retention in the primary index to one year.

Anyway, to put data in a summary index, you have to add, at the end of your scheduled search the following command:

| collect index=your_summary_index

as you can see at https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Collect .

Ciao.

Giuseppe

0 Karma

kajalchopade071
Path Finder

Thank you 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kajalchopade071,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...