I'm trying to set up a summary index using the sitimechart command. I read a lot about it, in the docs and in this forum, but couldn't find the solution yet.   My search is as follow: index=_internal service=A level=30 | timechart span=1m avg(durationMS) count Now, this search return a timechart with the duratoin and count in every minute. When running it with a summary index, I get different result index=_internal service=A level=30 | sitimechart span=1m avg(durationMS) count I get all the psrsvd fields, without the actual count and durationMS. It seems I need to calculate it again from psrsvd_ct_durationMS and psrsvd_sm_durationMS, which is not what I want.   The docs says that I should be able to run the same search on the summary index and get the same results. What am I missing? ... View more

I have followed this guide. My search is a simple one, just to export errors to another index: index=index_1 ... level>30 After the scheduled job finished running, the index is empty. I am a bit confued when to use the collect command. I have configured the search (report) with the summary index, but nothing happened... What am I doing wrong? ... View more

My web application logs every user action. Every log entry contains the user id, the action (click, double-click etc...), timestamp and a short description. The logs for a specific user are stored for a few days, hence I need to aggregate them to a processed report / data. I want to collect (and eventually display) a specific action (let's say double click) of each user and its description. For example, I want a table that gets updated for every log (or a few logs with some delay), that aggregates the data of a userId, the timestamp of all of his double clicks, the count of double clicks and the description for each double click. How can I solve this? What tools does splunk offer for something like aggregating log streams that gets removed? ... View more