Archive

how to initially setup a summary index ?

Skins
Path Finder

I have a report which is sloooow - seems like a good candidate for summary index. reading the docs it suggests configuring a saved search to run on an hourly basis to populate the previous hours data.

This dashboard panel will then show a months web transactions.

but how to set this up initially .. should i create a scheduled saved search to initially run over a month timeframe to initially populate the summary index - and then reconfigure to run hourly - or what ?

gratzi.

Tags (1)
0 Karma

deepashri_123
Motivator
0 Karma

somesoni2
Revered Legend

You would schedule it to run per your desired frequency, i.e. Hourly, to summary index data from now on. Then you would backfill the summary index for the desired duration, constrain by amount of raw data you've available. The backfill process can be found here:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Managesummaryindexgapsandoverlaps

The backfill can only be done for period you've actual/raw data available. The backfill period should be just before you scheduled it run.

ddrillic
Ultra Champion

Before you embark on a summary index journey, please consider report acceleration as it's a simpler feature and Splunk tries to stir us in this direction.

Skins
Path Finder

gratzi - accelerated the report and it gave me exactly what i was looking for.

0 Karma

paulbannister
Communicator

Hi There,

Short answer would be... both

Slightly longer answer depends of whether you want any historical data to work with/how long it will take to run the search over a months worth of data, or if you're happy to just populate with data from the time you click go

I'm assuming you've done everything you can to optimise the search you have, if that's the case then summary index is definitely the way to go

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!