Getting Data In

How to create a summary index for my csv file

JoshuaJohn
Contributor

On a daily basis I have a CSV loaded into splunk. I want to create a summary index so that this CSV will have historical data. Currently this file overwrites itself daily.

I have access to savedsearches.conf

Is there a tutorial for this somewhere, or a template I can follow?

0 Karma

somesoni2
Revered Legend

This should give you details of summary indexing process.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Knowledge/Usesummaryindexing#Set_up_summary_i...

Again, the traditional use for summary indexing is for optimizing searches/reports/dashboards, but it can be used for your use-case. You don't have to use any SI commands, so you can use use the like this (assuming CSV you upload as lookup)

| inputlookup yourUploadeda.csv 
0 Karma

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...