- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Should a summary index be created on both Sear...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I created a new index (test_summary) in the Indexer for storing summary data.
Then I created a new report in Search Head and enabled it for Summary Indexing. At the time of enabling, you normally have to pick your summary index from "Select the Summary Index" drop-down. The drop-down was showing the new index (test_summary) that created in the Indexer.
When the summary job was triggered out of the report, I started seeing error message in the Search Head saying:
test_summary index was either disabled/deleted or does not exist
Do we need to create the index in the Search Head as well? I don't think we would want to maintain the summary indexed data on the Search Head.
Any advice?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi jagadeeshm,
It might sound strange, but yes you need to add the index to the search head as well.
Don't worry about storing data on the search head, because if you setup data forwarding on your search head and tell Splunk just to forward the local event and not to store it you will have no local summary data on the search head.
See the docs http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/Forwardsearchheaddata about the best practice to forward logs from search heads to the indexers. The option indexAndForward = false is the one which prevents Splunk from keeping a local copy of your events.
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi jagadeeshm,
It might sound strange, but yes you need to add the index to the search head as well.
Don't worry about storing data on the search head, because if you setup data forwarding on your search head and tell Splunk just to forward the local event and not to store it you will have no local summary data on the search head.
See the docs http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/Forwardsearchheaddata about the best practice to forward logs from search heads to the indexers. The option indexAndForward = false is the one which prevents Splunk from keeping a local copy of your events.
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@MuS - Thanks for the quick reply. Yes, it is a bit strange that it shows the index created on the Indexer in the Search Head dropdown but doesn't actually store in there. Is this the most common and best approach to create Summary Indexes?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I created the outputs.conf here - /opt/splunk/etc/apps/SplunkForwarder/local. Is this correct?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where am I saying that forward events of test_summary ony?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you only want to forward events for the summary index, you need to apply some route and filtering http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Routeandfilterdatad but why would you do that? Forward everything, specially the _internal events you will need them in case of troubleshooting 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I set a forwarder NOW, will it forward EVERYTHING from Search Head to the Indexer? Or is it only for the events moving forward?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You will get the internal and summary from the moment you enable the forwarding on the search heads. What are your concerns? It will not effect your license usage, since internal logs and summary event do not count against your license usage.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not worried about the license. As soon as I created the test_summary index on the Search Head I started seeing the summary data in there. I was wondering now that I enabled forwarding on the Search Head, will it forward everything from the test_summary index from the Search Head to the Indexer or is it just for the events moving forward only?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As I said, it will not create anything on the search head in the summary index - all events are forwarded to the indexers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Another question - Summary Indexing doesn't take up license usage. But when this data is forwarded to the Indexer, does it take up additional usage? That will be REALLY bad!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please accept this answer if it solved your problem - thanks 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My summary index is configured to run every hour and summarize the data the hours before. Like described in the document, I have the forwarding enabled in the Search Head for all events.
However, my events in the summary index on the indexer are at least 4 hours behind.
How to debug this situation further?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Before the forwarding was enabled, my scheduled Report for summarizing ran twice and i had events sitting in the Search Head. After the forwarding was set-up, it looks like new events are being forwarded to the Indexer, but how can I get the exiting ones also into the Indexer?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, summary index events do not count against the license usage - from the docs http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Configuresummaryindexes :
Summary indexing volume is not counted against your license, even if you have several summary indexes. In the event of a license violation, summary indexing will halt like any other non-internal search behavior.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perfect, Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I enabled the forwarding like I mentioned in the doc, but I don't see my events flowing to Indexer...what is the best way to validate this ?
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
