topic Re: How do you create a summary index? in Knowledge Management

How do you create a summary index?

1dbenzo — Wed, 06 Apr 2011 09:57:36 GMT

Hello, can anybody tell me how to "create a summary index"?

Re: How do you create a summary index?

Ayn — Wed, 06 Apr 2011 11:43:46 GMT

The Knowledge Manager Manual has excellent information on this:

http://www.splunk.com/base/Documentation/4.2/Knowledge/Usesummaryindexing

http://www.splunk.com/base/Documentation/4.2/Knowledge/Configuresummaryindexes

Re: How do you create a summary index?

therealdpk — Tue, 16 Oct 2012 23:01:57 GMT

The documentation is not very clear on one point: It says you simply run "eventtype = firewall | stop src_ip" and that creates a summary index named "summary". Where did that name come from and what if I want two summary indexes to exist?

Re: How do you create a summary index?

_d_ — Wed, 17 Oct 2012 03:43:24 GMT

To create an index (whether or not it will be used for summaries does not matter) follow the instructions here:

Set up multiple indexes

Re: How do you create a summary index?

skulk — Thu, 05 Apr 2018 13:38:30 GMT

Pretty good intro in Summary Indexes
https://www.splunk.com/view/SP-CAAACZW