Hi,
I am creating a summary index, and want to makes these fields available via tstats - is that possible?
It is either/or. If you need tstats
then you should use an Accelerated Data Model
instead of Summary Index
:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Acceleratedatamodels
It is either/or. If you need tstats
then you should use an Accelerated Data Model
instead of Summary Index
:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Knowledge/Acceleratedatamodels
Thanks!
No they are not index-time fields by default.
You will have to define custom index-field extractions using transforms.conf or props.conf settings in order to achieve that.
I assume you are not using the si-
commands to generate the fields and, therefore, likely using another sourcetype other than stash. If you are and you are using the collect
command to do this, please note that you are impacting your indexing volume license allocation.