Need to create a summary index from the existing raw data to include the 13 fields in the attachment. The index needs to be created every 5 mins, 60 mins, and on a daily basis while being retained for a period of 13 months.
I would like to how to retain this for 13 months and is using stats is a correct method to include fields that i need?
Right now i have created the following savedsearches.conf
[30159_cso_stratus_summaryindex]
action.summary_index = 1
action.summary_index._name = cso_stratus_summary
action.summary_index.report = cso_stratus_summaryindex
alert.digest_mode = True
alert.expires = 4h
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = */5 * * * *
description = summary index for cso stratus
dispatch.earliest_time = -5m
dispatch.latest_time = now
enableSched = 1
realtime_schedule = 0
search = search = index="iiiiiuiiiiiiiii" sourcetype="ssssjjsjsjsjjsjs" |stats count by xxxx,yyyyy,azzzzzz,ccccc,cccc
[30159_cso_stratus_summaryindex]
action.summary_index = 1
action.summary_index._name = cso_stratus_summary
alert.digest_mode = True
alert.expires = 4h
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = */10 * * * *
description = summary index for cso stratus
dispatch.earliest_time = -10m
dispatch.latest_time = now
enableSched = 1
realtime_schedule = 0
search = index="iiiiiuiiiiiiiii" sourcetype="ssssjjsjsjsjjsjs" |stats count by xxxx,yyyyy,azzzzzz,ccccc,cccc
Hello, deepthi5
You can specify fields to write in summary index using | table command.
About retention period It could be specified in indexes.conf using parameter "frozenTimePeriodInSecs"
frozenTimePeriodInSecs = .
Yes, use | stat
s to summarize to the level you want, and |table
to eliminate all unnecessary fields.