Getting Data In

When we need si* for summary indexing?

hochit
Path Finder

Is it necessary to use si* command for summary index and we need to make it as scheduled save?

Since I recall the saved search (it's not using si*), it still returns me the result as quick as I recall it from index=summary. Or Splunk actually is doing the trick for me?

rroberts
Splunk Employee
Splunk Employee

If you havent already seen it there is a good article here and link to video ... http://www.splunk.com/base/Documentation/4.2/Knowledge/Usesummaryindexing

"Note: You do not have to use the si- summary index search commands if you are proficient with the "old-school" way of creating summary-index-populating searches. If you create summary indexes using those methods and they work for you there's no need to update them. In fact, they may be more efficient: there are performance impacts related to the use of the si- commands, because they create slightly larger indexes than the "manual" method does."

gkanapathy
Splunk Employee
Splunk Employee

Hmm. It's not always true that si generates large results. For example, for computing medians and percentiles, si will likely be considerably more efficient than whatever you come up with manually. However, there will also be cases where you can't use si commands to summarize and retrieve the data as you need.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...