Can Splunk report on original events, even if new events for same day get indexed later?

Suppose you have the following scenario:

1 - Logs come in for a certain day, say Feb 5, 2011

2 - A report is generated for Feb 5, 2011

3 - After the report is generated, could be some days afterward, some additional logs arrive for Feb 5, 2011
(i.e. there was a delay in sending them on the day the log was generated on the device)

Now, suppose your requirement is if a report is re-generated for Feb 5, 2011, it must match the original results, ignoring any of the new data for Feb 5 that came in and got indexed afterward.

Is there a way to do this in Splunk? If so, what would be the most efficient way? Summary Indexing, perhaps?

asked 28 Feb '11, 16:19

maverick ♦
2.6k●6●5●73
accept rate: 14%

3 Answers:

oldest newest most voted

3	Another suggestion is to sort out ONLY events that are indexed on Feb 5, 2011 using the internal field _indextime. link answered 28 Feb '11, 16:49 tmartin 56●1 accept rate: 50%

One way might be to run a daily report that summarizes the report statistics into the summary index (different index) and then from that point forward, you would recreate the report from the summary index instead of the raw events in main index, thus avoiding the possibility of including the extra events that got indexed late.

link

answered 28 Feb '11, 16:46

maverick ♦
2.6k●6●5●73
accept rate: 14%

you could probably also add in a new field called "reportdate" into the summary report with the text-based date value like "Feb 5, 2001" and then search on that field.

(28 Feb '11, 16:48) maverick ♦

Hey Mavrick,

To do this base your report off of a scheduled search. Keep those results around for a week or longer depending on the time window here and have that report load from cache in a dashboard.

Also consider setting up the search as a pdf alert, then you have the pdf frozen in time, and accessible afterward.

link

answered 28 Feb '11, 16:52

DrewO
112●4
accept rate: 11%

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

search ×1,083
configuration ×309
data ×64
reporting ×11
wherehouse ×2

Asked: 28 Feb '11, 16:19

Seen: 682 times

Last updated: 28 Feb '11, 16:52

Can Splunk report on original events, even if new events for same day get indexed later?

Follow this question

Splunk Resources

Related questions