Sumary index not extracting fields as in source index

[anantdeshpande]

Hi team,

I want to copy complete data to summary just because it has longer retention period in my environment. I am not doing any stats on data. Below command works fine and I can see the data as per scheduled report. However when I look at the data in summary index, the fields are not extrated as it is in source index.

I serached and feel that writing transforms is the only way to extract fields in summary index. Can some one confirm.

index=index123 source=test.csv sourcetype=new | collect index=index123_summary source=test.csv sourcetype=new

[DalJeanis · Accepted solution]

As a general case, yes.

If you haven't specified the fields to save to the summary index, then probably you are saving _raw and a few other fields, and you are going to have to specify, for the system, all the extractions that it has already been told how to do on the old data. Presumably, most of those are related to the old sourcetype, so you should be able to clone the old sourcetype stanzas to the new ones, without having to replicate the transforms themselves.

This attempt should be subjected to extensive testing in your test/dev/qa environment if you have one.

[anantdeshpande]

Thank you.