Knowledge Management

How to create a summary index that runs once in a week and I want only few fields to be populated in the summary index?

Poojitha
Path Finder

Hi All, 

I am trying to create a summary index that runs once in a week and I want only few fields to be populated in the summary Index. 

Questions :

1) I want only three fields in Summary Index - Test1 , Test2, Test3.
             Can I use table command on these 3 fields  at end of my query and create a report to populate              Summary Index ? If I use fields command, it is not showing the above fields in my  Index ? Why is it ? 
I want these fields to be in SI so that I can run different stats command and make use in my dashboard.

2) Also, I have used timerange of last  7 days  ( to summary index last 7 days data) but only first 3 days data is being written to SI ? I dont see any errors ? I googled this question but I am not getting exact answer, Can anyone please help me to understand this please. 


Thanks in Advance.
Newbie to Splunk


Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Poojitha,

in Summary indexes you can use only the output of streaming commands and fields isn't one of them, use table.

In addition I hint to always record in Summary also "_time" to have the timestamp of the events to use in timechart command.

Maybe (I'm not sure but it's difficoult to check) the problem of your missing data is related to this.

Ciao.

Giuseppe

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Poojitha,

in Summary indexes you can use only the output of streaming commands and fields isn't one of them, use table.

In addition I hint to always record in Summary also "_time" to have the timestamp of the events to use in timechart command.

Maybe (I'm not sure but it's difficoult to check) the problem of your missing data is related to this.

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...