I have a summary index I am looking to put data in.
| table Name,host,_time, component, operation, userName, responseTimeSeconds
| fields - _raw
This is the basis of what I have. When putting it into the summary index I was hoping to have only the fields specified in my table. Instead I am getting things like the following included:
08/26/2019 12:29:59 -0400, search_name=savedReport, search_now=1566837000.000, info_min_time=1566836700.000, info_max_time=1566837000.000, info_search_time=1566837197.992,
Is there any way strip out this information in my index? Will it automatically add it. I used collect
with testmode=true
and thought that should indicate what my output looks like. Is there a step I am missing or is that what I should expect to have in my data? For awareness what I am trying to do is gather some data we want that will stay around longer than our current setup by stripping out a lot of items in the logging we do not need.
That is just the way that it works. If you have spare license, you can always use the Log Event
action, but it is not free like Summary Index
is.
That is just the way that it works. If you have spare license, you can always use the Log Event
action, but it is not free like Summary Index
is.
@woodcock Thanks for the insight.