Getting Data In

Recommendation for segregating data between product test runs

ssledzie
New Member

If I'm doing product testing and wanted to store data from test runs, how would you recommend associating events with a test id/test run id?

Should I annotate the actual log data with a testid?

Should I create a new event type that enumerates every event source for the test run?

Is there a better way I'm not thinking of? Advice is appreciated.

Tags (3)
0 Karma

lukejadamec
Super Champion

Once each test run is complete you can add it with specific identifying information to a single summary index. It is not exactly what a summary index is intended to be used for, but it should work just fine, and you will only have one index that contains all test results with each result essentially tagged with test information. See this doc:

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Configuresummaryindexes

Once you have transferred the information to the summary index, you can use the delete command on the same search you used to populate the summary to delete the data from the main index. Be sure to read the info on the delete command!

http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Delete

0 Karma

ssledzie
New Member

Okay let me think about that. It seems like a feasible solution. Thanks.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I am using around 150+ indexes and don't see any issues with it. There benefits like I can handle accessibility on the data more easily as I can define different roles for different indexes

0 Karma

ssledzie
New Member

Is there a drawback to creating many indexes? Hundreds possibly?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I would suggest storing the data in separate index so that it can be removed easily later.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...