Hi @gcusello When you said it's possible to add new field into past data in a summary index, is it a new entry/insert or an update ? In my example, Is it possible to update (not insert) "Phone"...
See more...
Hi @gcusello When you said it's possible to add new field into past data in a summary index, is it a new entry/insert or an update ? In my example, Is it possible to update (not insert) "Phone" field in "test_1" past data (_time/timestamp is in the past) ? Do I need to have permission to perform an update to an index? I think I only can perform insert, but not delete or update Your sample query is moving new data to the new index "test_2", not to same "test_1" past data if you have these information in a lookup, way do you need to save it in the index? the main_index has a large set of data, it's very slow doing a lookup in dashboard, that's why i filtered necessary data and moved it to summary index Past:
index=main_index + csv data ===> index=summary report="test1"
Now: I updated csv data with a phone field
index=main_index + csv data ===> index=summary report="test2"
Can I update (not insert) only "phone" field from "test2" to "test1" with Past timestamp? OR Can I update (not insert) only "phone" field from "main index+CSV" to "test1" with Past Timestamp?
index=main_index + csv data (NEW) ===> index=summary report="test1" (PAST Timestamp)
Thank you