topic Are there summary index naming convention standards? in Knowledge Management

Are there summary index naming convention standards?

cesaccenturefed — Wed, 23 Nov 2016 00:08:29 GMT

So I need to set up a summary index for our reporting team to do our monthly reports. Are there any naming conventions that I need to abide by?

If I name the index "report" or "report_summary", does it matter? Does the name matter when counting against your license? Are events in summary indexes exempt from your license count? How are summary events not counted towards your license?

Re: Are there summary index naming convention standards?

skoelpin — Wed, 23 Nov 2016 00:29:22 GMT

I typically add "DO NOT CLICK" as the prefix of the report name so I accidentally don't click it and run another populating search.. Also make sure the permissions are set to private so other users cant run the populating search.

The only thing that will count against your licenses is if you index more data, so "reindexing" your data which was already indexed will not count against your licenses, so your safe to run as many summary indexes as you wish.

Re: Are there summary index naming convention standards?

woodcock — Sat, 11 Mar 2017 20:25:23 GMT

HA! You got that from me! 😆 I am glad to see that it has worked all those years!

Re: Are there summary index naming convention standards?

skoelpin — Sat, 11 Mar 2017 23:42:17 GMT

Yes I did!

Naming convention is everything, especially when scaling

Re: Are there summary index naming convention standards?

anwarmian — Tue, 29 Sep 2020 23:06:16 GMT

You can use the guideline documented in:
https://docs.splunk.com/Documentation/CoE/current/Handbook/Naming

For summary index use:
companyname_purpose_sensitivity_summary naming convention

Example: acme_report_prod_summary
or
yourcompanyname_report_dev_summary