Building for the Splunk Platform

how to initially setup a summary index ?

Path Finder

I have a report which is sloooow - seems like a good candidate for summary index. reading the docs it suggests configuring a saved search to run on an hourly basis to populate the previous hours data.

This dashboard panel will then show a months web transactions.

but how to set this up initially .. should i create a scheduled saved search to initially run over a month timeframe to initially populate the summary index - and then reconfigure to run hourly - or what ?


Tags (1)
0 Karma

0 Karma


You would schedule it to run per your desired frequency, i.e. Hourly, to summary index data from now on. Then you would backfill the summary index for the desired duration, constrain by amount of raw data you've available. The backfill process can be found here:

The backfill can only be done for period you've actual/raw data available. The backfill period should be just before you scheduled it run.

Ultra Champion

Before you embark on a summary index journey, please consider report acceleration as it's a simpler feature and Splunk tries to stir us in this direction.

Path Finder

gratzi - accelerated the report and it gave me exactly what i was looking for.

0 Karma


Hi There,

Short answer would be... both

Slightly longer answer depends of whether you want any historical data to work with/how long it will take to run the search over a months worth of data, or if you're happy to just populate with data from the time you click go

I'm assuming you've done everything you can to optimise the search you have, if that's the case then summary index is definitely the way to go

0 Karma
Get Updates on the Splunk Community!

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...