How to ingest data Into summary index?

[IRHM73]

Hi, I wonder whether someone may be able to help me with some advice please.

I'm wanting to set up a Summary Index on my Splunk environment which I'm pretty well versed at.

But my question is as follows:

Am I better pushing data into the SI at the highest level i.e. index/auditSource as shown below:

`wso2_wmf(APIRequestCompleted)` 

and then running more granular queries from this.

Or am I better pushing data into the SI with the more granular data as below and partitioning the data for each separate query, of which there will be man, but will use the same auditSource/Index combination but different auditTypes for each query, an example of which is as below.

`wso2_wmf(APIGatewayRequestCompleted)` "request.detail.apiContext"!="customer-profile" 
| timechart span=1d limit=100 count by request.detail.apiContext

Many thanks and kind regards

Chris

[somesoni2]

Its a summary index search so there should be some level of summarization happening in the summary index search.

[IRHM73]

Hi @somesoni2, thank you for the advice.

Kind Regards

Chris

[adonio]

can you kindly elaborate?
what does your macro do? can you share the full search?
what is the purpose of SI and what is the desired outcome?

[IRHM73]

Hi @adonio, thank you for coming back to me with this and I'm sorry I wasn't able to reply immediately.

The macro we use, combines the index, auditSouce and auditType and in terms of elaborating on the search there are only a few more request.detail.apiContext' in addition to what you see.

The reason for using the SI is so users can run long range searches more efficiently.

I hope this helps.

Many thanks and kind regards

Chris