Splunk query

[kajalchopade071]

I have One primary index which contains 30 days logs, but i want from one year for this purpose i created One more splunk summary index where i can copy One month Data (Jan) ,after one month again one month data (Feb) likewise... So how can i copy one month data from One index to another 

[gcusello · Accepted solution]

Hi @kajalchopade071,

the correct use of summary indexes is to contain elaborated data, so you should create a search that already summarize informations (e.g. stats) or a search that contains only the fields you really needs.

If you want all the events of the original index, the best approach is to modify the retention in the primary index to one year.

Anyway, to put data in a summary index, you have to add, at the end of your scheduled search the following command:

| collect index=your_summary_index

as you can see at https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Collect .

Ciao.

Giuseppe

[kajalchopade071]

Thank you 

[gcusello]

Hi @kajalchopade071,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉