I have a little problem with summary indexing seemingly ignoring some fields.
My logfile looks like this:
I've scheduled an index-populating query called "index-populating-query" that runs every 15 minutes and saves its results to the summary index:
When I run this query from search, Splunk correctly shows all the discovered fields on the left hand side: tx, orderId, outcome, execution_time_ms.
But when I run queries against the summary index, it seems that the fields tx and outcome aren't contained in the index:
produces an empty result set, and
shows the fields orderId and execution_time_ms on the left hand side, but no outcome or tx.
Does anyone have an explanation for this behaviour?
I noticed that the missing fields are the ones that aren't following a comma in the log file.
The outcome field could probably be extracted during my queries against the summary index using a regex (e.g. rex "(?i) outcome=(?P<outcome>[^,]+)"), but doesn't that somehow defeat the purpose of summary indexing?
asked 30 Jun '11, 01:07
In general, summary index generating searches need to use a transforming/reporting command such as timechart, stats, chart, etc.
So, you could change your search to be something like:
Then, your search against the summary index becomes something like:
And would yield a result like:
answered 05 Dec '11, 13:48