Dashboards & Visualizations

How to use summary indexing in dashboards?

Path Finder

Hi,

I am new to Summary Indexing. Can you please let me know how to use summary indexing in dashboards?

From documentation, we can enable this for reports or alerts, but how can we enable this for dashboards?

Thanks

0 Karma
1 Solution

Influencer

Summary indexing works on the data layer and not on dashboards.

You summarize your raw data into an aggregated form and store in a seperate index so that your dashboard searches runs faster on a pre aggregated, less amount of data when compared to raw data

http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Usesummaryindexing

If you want to do it at search/report level instead of data level, You can use Report Acceleration where splunk itself runs the summary for your dashboard search behind the scenes. There are few restrictions though.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Report/Acceleratereports

View solution in original post

Influencer

Summary indexing works on the data layer and not on dashboards.

You summarize your raw data into an aggregated form and store in a seperate index so that your dashboard searches runs faster on a pre aggregated, less amount of data when compared to raw data

http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Usesummaryindexing

If you want to do it at search/report level instead of data level, You can use Report Acceleration where splunk itself runs the summary for your dashboard search behind the scenes. There are few restrictions though.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Report/Acceleratereports

View solution in original post

Path Finder

So, do we need to initially set up a reports and enable summary indexing on that report to use this for dashboards?

0 Karma

Influencer

Right, you set up a search whose results you want to summarize, schedule it and select Enable Summary indexing and give a report name of your choice and index of your choice to send the data to. And then change your dashboard searches to search for the data in the summary index than the raw index.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!