https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397833#M115444 <P>Please consider the new features, such as report acceleration before attempting the legacy tricky summary index.</P> Thu, 09 Aug 2018 16:31:45 GMT ddrillic 2018-08-09T16:31:45Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397832#M115443 <P>I am trying to build a summary index to pull a week over week comparison of specific applications. The below query works normally, but for efficiency reasons I would like to place this in a summary index. I am having trouble getting the results I want displayed for the comparison in question. My results with <CODE>sitimechart</CODE> are using the date and time that the data was ingested into the Summary Index which prevents my comparison method from working. </P> <P>The search results off of the summary index places events in a "NULL" column and does not follow the eval statements.</P> <PRE><CODE>index=1 host=1234 sourcetype=sourcetype application=app earliest=-2w@w latest=@w | eval marker = if (_time &lt; relative_time(now(), "-1w@w"), "last week", "this week") | eval _time = if (marker=="last week", _time + 7*24*60*60, _time) | timechart count by marker cont=FALSE </CODE></PRE> <P>See attached for stats table</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5529i475043900DA2F088/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 09 Aug 2018 16:29:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397832#M115443 a109120 2018-08-09T16:29:29Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397833#M115444 <P>Please consider the new features, such as report acceleration before attempting the legacy tricky summary index.</P> Thu, 09 Aug 2018 16:31:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397833#M115444 ddrillic 2018-08-09T16:31:45Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397834#M115445 <P>You should try using the <CODE>collect</CODE> command to put into a summary index and query it. This will also include _time so its broken in the correct days, just as your table is showing </P> <PRE><CODE> index=1 host=1234 sourcetype=sourcetype application=app earliest=-2w@w latest=@w | eval marker = if (_time &lt; relative_time(now(), "-1w@w"), "last week", "this week") | eval _time = if (marker=="last week", _time + 7*24*60*60, _time) | timechart count by marker cont=FALSE | collect index=summary </CODE></PRE> <P>Then when its collected, you can then query your summary index </P> <PRE><CODE>index=summary sourcetype=.. | timechart span=1d max(last_week) AS last_week max(this_week) AS this_week </CODE></PRE> Thu, 09 Aug 2018 17:26:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397834#M115445 skoelpin 2018-08-09T17:26:14Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397835#M115446 <P>Agreed that an accelerated data model would probably be better, but it would depend on the scenario. An accelerated data model eats up disk space for the additional tsidx files and also consumed 3 concurrent searches every 5 mins to update the summary range. This is a lot of overhead if OP wants a simple solution with minimal overhead. I wouldn't consider a summary index old legacy tricky technology.. ITSI uses it and doesn't plan on ditching it anytime soon</P> Thu, 09 Aug 2018 17:28:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397835#M115446 skoelpin 2018-08-09T17:28:10Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397836#M115447 <P>Yes that is exactly why I am looking into summary indexing. I am trying to avoid using up the large amount of resources.</P> Thu, 09 Aug 2018 17:52:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397836#M115447 a109120 2018-08-09T17:52:49Z https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397837#M115448 <P>I gave this a try and the timechart did not assign any values to the this_week/last_week columns. I think I have a few ideas to get that to work. Thanks for the input </P> Tue, 29 Sep 2020 20:50:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-build-a-summary-index-that-uses-eval-statements-to/m-p/397837#M115448 a109120 2020-09-29T20:50:13Z