topic Re: How to ingest data Into summary index? in Getting Data In

How to ingest data Into summary index?

IRHM73 — Tue, 10 Apr 2018 06:01:43 GMT

Hi, I wonder whether someone may be able to help me with some advice please.

I'm wanting to set up a Summary Index on my Splunk environment which I'm pretty well versed at.

But my question is as follows:

Am I better pushing data into the SI at the highest level i.e. index/auditSource as shown below:

`wso2_wmf(APIRequestCompleted)`

and then running more granular queries from this.

Or am I better pushing data into the SI with the more granular data as below and partitioning the data for each separate query, of which there will be man, but will use the same auditSource/Index combination but different auditTypes for each query, an example of which is as below.

`wso2_wmf(APIGatewayRequestCompleted)` "request.detail.apiContext"!="customer-profile" 
| timechart span=1d limit=100 count by request.detail.apiContext

Many thanks and kind regards

Chris

Re: How to ingest data Into summary index?

adonio — Tue, 10 Apr 2018 13:09:47 GMT

can you kindly elaborate?
what does your macro do? can you share the full search?
what is the purpose of SI and what is the desired outcome?

Re: How to ingest data Into summary index?

somesoni2 — Tue, 10 Apr 2018 19:32:50 GMT

Its a summary index search so there should be some level of summarization happening in the summary index search.

Re: How to ingest data Into summary index?

IRHM73 — Wed, 11 Apr 2018 05:35:57 GMT

Hi @adonio, thank you for coming back to me with this and I'm sorry I wasn't able to reply immediately.

The macro we use, combines the index, auditSouce and auditType and in terms of elaborating on the search there are only a few more request.detail.apiContext' in addition to what you see.

The reason for using the SI is so users can run long range searches more efficiently.

I hope this helps.

Many thanks and kind regards

Chris

Re: How to ingest data Into summary index?

IRHM73 — Wed, 11 Apr 2018 05:38:05 GMT

Hi @somesoni2, thank you for the advice.

Kind Regards

Chris