Splunk Search

Sumary index not extracting fields as in source index

anantdeshpande
Path Finder

Hi team,

I want to copy complete data to summary just because it has longer retention period in my environment. I am not doing any stats on data. Below command works fine and I can see the data as per scheduled report. However when I look at the data in summary index, the fields are not extrated as it is in source index.

I serached and feel that writing transforms is the only way to extract fields in summary index. Can some one confirm.

index=index123 source=test.csv sourcetype=new | collect index=index123_summary source=test.csv sourcetype=new

Tags (1)
0 Karma
1 Solution

DalJeanis
Legend

As a general case, yes.

If you haven't specified the fields to save to the summary index, then probably you are saving _raw and a few other fields, and you are going to have to specify, for the system, all the extractions that it has already been told how to do on the old data. Presumably, most of those are related to the old sourcetype, so you should be able to clone the old sourcetype stanzas to the new ones, without having to replicate the transforms themselves.

This attempt should be subjected to extensive testing in your test/dev/qa environment if you have one.

View solution in original post

0 Karma

DalJeanis
Legend

As a general case, yes.

If you haven't specified the fields to save to the summary index, then probably you are saving _raw and a few other fields, and you are going to have to specify, for the system, all the extractions that it has already been told how to do on the old data. Presumably, most of those are related to the old sourcetype, so you should be able to clone the old sourcetype stanzas to the new ones, without having to replicate the transforms themselves.

This attempt should be subjected to extensive testing in your test/dev/qa environment if you have one.

0 Karma

anantdeshpande
Path Finder

Thank you.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...