topic Re: About Summary Indexing in Getting Data In

About Summary Indexing

christantoy — Fri, 07 Sep 2012 12:03:50 GMT

Good day!

May i ask you guys a favor can you tell us on how we can use Summary indexing or how to configure it? i have already seen the document about summary indexing but i'm still didn't understand on how i can apply the summary indexing into may search.

Thank you in advance sorry with my little poor english

Regards
Cris

Re: About Summary Indexing

MuS — Fri, 07 Sep 2012 12:22:34 GMT

Hi christantoy

the easiest way is to create a search that suits your needs, save it. Then in Manager » Searches and reports click your saved search and schedule it, enable summary indexing and your done with your first summary index.

Remember that the summary index only contains the data it gets through your saved search, meaning you can only that data in your summary index and nothing else.

hope this helps to get you started....

cheers,

MuS

Re: About Summary Indexing

christantoy — Fri, 07 Sep 2012 12:51:54 GMT

Hi MuS

I appreciate your answer thank you! but is there another way? i been seen this documentation. please take a look.

http://wiki.splunk.com/Community:Summary_Indexing

what do you think? is this work?

Thanks in advance

Regards
Cris

Re: About Summary Indexing

MuS — Fri, 07 Sep 2012 12:55:58 GMT

sure will this work, basically it is the same as I wrote you just with bit more explanation around it 🙂

Re: About Summary Indexing

christantoy — Fri, 07 Sep 2012 13:02:23 GMT

Ohh ic ic but im still wondering what the use of this search string "starthoursago=26 endhoursago=2" or is this the same if i go for the CRON set-up??

Thanks in advance
Cris

Re: About Summary Indexing

MuS — Fri, 07 Sep 2012 13:06:09 GMT

this to limit the search in time, meaning start searching 26 hours ago and stop 2 hours ago from that time when the search started. the cron like stuff would be if you schedule your search

Re: About Summary Indexing

christantoy — Fri, 07 Sep 2012 13:15:06 GMT

Ok got it but can i ask you again after i do a test for it?

thanks a lot!

Regard
Cris