Hi team, I have below query to search out all raw data and out put to a table format: index=testIndex AND sourcetype=testType AND ACT!="-" AND "DT=MANUALEVENT" AND C_PG="DEVELOPMENT_GOAL_V2" OR C_...
See more...
Hi team, I have below query to search out all raw data and out put to a table format: index=testIndex AND sourcetype=testType AND ACT!="-" AND "DT=MANUALEVENT" AND C_PG="DEVELOPMENT_GOAL_V2" OR C_PG="PERFORMANCE_GOAL_V2" | table _time, SFDC, CMN, CMID, CIP, SID, PUID, UID, MID, PID, C_PG,C_SPG, ACT There're 6 different metrics/panels in the dashboard to stats based on this query result, Question: How to create the summary index based on above query? I found that all the summary index command are below 5 si commands per this official document https://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Usesummaryindexing , and I can't figure out which one to use to match my scenario. sichart sitimechart sistats, sitop, sirare