How to use summary indexing in dashboards?

[splunker9999]

Hi,

I am new to Summary Indexing. Can you please let me know how to use summary indexing in dashboards?

From documentation, we can enable this for reports or alerts, but how can we enable this for dashboards?

Thanks

[pradeepkumarg · Accepted solution]

Summary indexing works on the data layer and not on dashboards.

You summarize your raw data into an aggregated form and store in a seperate index so that your dashboard searches runs faster on a pre aggregated, less amount of data when compared to raw data

http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Usesummaryindexing

If you want to do it at search/report level instead of data level, You can use Report Acceleration where splunk itself runs the summary for your dashboard search behind the scenes. There are few restrictions though.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Report/Acceleratereports

[splunker9999]

So, do we need to initially set up a reports and enable summary indexing on that report to use this for dashboards?

[pradeepkumarg]

Right, you set up a search whose results you want to summarize, schedule it and select Enable Summary indexing and give a report name of your choice and index of your choice to send the data to. And then change your dashboard searches to search for the data in the summary index than the raw index.