Dashboards & Visualizations

How can summary indexing help improve the performance of my dashboards and reports

benstraw
Splunk Employee
Splunk Employee

I have a report on my dashboard that takes a very long time to build, how can I use summary indexing to improve the performance of this report?

Tags (2)
0 Karma
1 Solution

Simon
Contributor

It's really very simple. Look for this use case: You want to get a report on your dashboard with a summary of the number of errors per host from the last 24 hours. Your report without summary indexing would look like this:

index=yourindex ERROR starthoursago=24 | timechart count(_raw) by host

Now you change your search term like this:

index=yourindex ERROR startminutesago=30 | sitimechart count(_raw) by host

and save this search and select to schedule this search. Choose schedule type basic and run it every 30 minutes (must be equal to the value of startminutesago= in your search). Choose enable summary indexing and type "summary" in the field for the summary index name. This index exists already in your default splunk installation. I used to specify a custom field named «report» with the value of «my_custom_report» or whatever you like to. With this field you are able to find easier your results in the summary index. Now save the search. What will happen now? Every 15 minutes splunk runs the saved search and puts the data needed for the timechart in the summary index. You can now get this data with the following search:

index=summary report=my_custom_report | timechart count(_raw) by host

Use this report now for your dashboard and you will recognize that this report will build much faster.

There is a nice page in the splunk documentation too: http://www.splunk.com/base/Documentation/4.0.8/User/UseSummaryIndexingForIncreasedReportingEfficienc...

Let me know if you have further questions.

View solution in original post

Simon
Contributor

It's really very simple. Look for this use case: You want to get a report on your dashboard with a summary of the number of errors per host from the last 24 hours. Your report without summary indexing would look like this:

index=yourindex ERROR starthoursago=24 | timechart count(_raw) by host

Now you change your search term like this:

index=yourindex ERROR startminutesago=30 | sitimechart count(_raw) by host

and save this search and select to schedule this search. Choose schedule type basic and run it every 30 minutes (must be equal to the value of startminutesago= in your search). Choose enable summary indexing and type "summary" in the field for the summary index name. This index exists already in your default splunk installation. I used to specify a custom field named «report» with the value of «my_custom_report» or whatever you like to. With this field you are able to find easier your results in the summary index. Now save the search. What will happen now? Every 15 minutes splunk runs the saved search and puts the data needed for the timechart in the summary index. You can now get this data with the following search:

index=summary report=my_custom_report | timechart count(_raw) by host

Use this report now for your dashboard and you will recognize that this report will build much faster.

There is a nice page in the splunk documentation too: http://www.splunk.com/base/Documentation/4.0.8/User/UseSummaryIndexingForIncreasedReportingEfficienc...

Let me know if you have further questions.

Simon
Contributor

You're welcome.

0 Karma

benstraw
Splunk Employee
Splunk Employee

thanks for the detailed response!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...