Knowledge Management

How to create a summary index that runs once in a week and I want only few fields to be populated in the summary index?

Poojitha
Path Finder

Hi All, 

I am trying to create a summary index that runs once in a week and I want only few fields to be populated in the summary Index. 

Questions :

1) I want only three fields in Summary Index - Test1 , Test2, Test3.
             Can I use table command on these 3 fields  at end of my query and create a report to populate              Summary Index ? If I use fields command, it is not showing the above fields in my  Index ? Why is it ? 
I want these fields to be in SI so that I can run different stats command and make use in my dashboard.

2) Also, I have used timerange of last  7 days  ( to summary index last 7 days data) but only first 3 days data is being written to SI ? I dont see any errors ? I googled this question but I am not getting exact answer, Can anyone please help me to understand this please. 


Thanks in Advance.
Newbie to Splunk


Labels (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @Poojitha,

in Summary indexes you can use only the output of streaming commands and fields isn't one of them, use table.

In addition I hint to always record in Summary also "_time" to have the timestamp of the events to use in timechart command.

Maybe (I'm not sure but it's difficoult to check) the problem of your missing data is related to this.

Ciao.

Giuseppe

 

View solution in original post

gcusello
Esteemed Legend

Hi @Poojitha,

in Summary indexes you can use only the output of streaming commands and fields isn't one of them, use table.

In addition I hint to always record in Summary also "_time" to have the timestamp of the events to use in timechart command.

Maybe (I'm not sure but it's difficoult to check) the problem of your missing data is related to this.

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...