topic Re: Steby by Step Guide to use and build 'Summary Index' in Splunk Enterprise Security

Steby by Step Guide to use and build 'Summary Index'

beriwalnishant — Fri, 19 Mar 2021 09:16:41 GMT

Hello You all talented people out there,

May I request someone to please help me with a reference link or a video that explains well on usage and setting up Splunk Summary Indexes.

I tried finding but I don't find a very good detailed or properly explained reference anywhere.

I have 4 dashboards that I built which doesn't take a lot of data but using summary index we will be able to faster load it and less load on the server

Will I need to make changes to the queries used in the dashboard using it ? does it use your computer's hard disk when create a dedicated index, do we need to change the 'Index' details in our query with the one we will create for SI purpose...etc lot of questions better if I can get a step by step guide.

Thanks in advance

Nishant

Re: Steby by Step Guide to use and build 'Summary Index'

richgalloway — Fri, 19 Mar 2021 12:25:07 GMT

A summary index is no different from any other event index so you create and use SIs the same way you would any other event index. The user's hard disk (assuming there is one) is not used. Yes, you will have to change your dashboards to read from the SI. You also will need a scheduled search to populate/update the SI. See https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/Setupsummaryindexes and https://aditumpartners.com/what-is-summary-indexing/ for more information.

Re: Steby by Step Guide to use and build 'Summary Index'

beriwalnishant — Wed, 24 Mar 2021 00:49:54 GMT

Thanks, let me check and get back to you here if I have further questions, I feel hard time understanding 'splunk doc' pages so was more looking towards an easy guide or steps but let me give it a try again.

Nishant

Re: Steby by Step Guide to use and build 'Summary Index'

richgalloway — Wed, 24 Mar 2021 12:39:56 GMT

Any time you have difficulty understanding a Splunk docs page be sure to submit feedback on that page. The Docs team is very good about updating the documentation in response to user feedback.

Re: Steby by Step Guide to use and build 'Summary Index'

beriwalnishant — Wed, 24 Mar 2021 14:24:17 GMT

Understood thanks for advising.

Re: Steby by Step Guide to use and build 'Summary Index'

beriwalnishant — Mon, 23 Aug 2021 08:18:53 GMT

Hey Rich,

Had been very busy all this while. I am trying this link today but it gives me '404 Not found'

https://aditumpartners.com/what-is-summary-indexing/

May I request you to help me with an alternate link please

NIshant

Re: Steby by Step Guide to use and build 'Summary Index'

richgalloway — Mon, 23 Aug 2021 12:40:24 GMT

The 404 page on that site has a search box which makes finding pages trivial. Try https://www.sp6.io/blog/what-is-summary-indexing/

Re: Steby by Step Guide to use and build 'Summary Index'

beriwalnishant — Mon, 23 Aug 2021 13:11:08 GMT

Super thanks a lot