Getting Data In

When we need si* for summary indexing?

Path Finder

Is it necessary to use si* command for summary index and we need to make it as scheduled save?

Since I recall the saved search (it's not using si*), it still returns me the result as quick as I recall it from index=summary. Or Splunk actually is doing the trick for me?

Splunk Employee
Splunk Employee

If you havent already seen it there is a good article here and link to video ...

"Note: You do not have to use the si- summary index search commands if you are proficient with the "old-school" way of creating summary-index-populating searches. If you create summary indexes using those methods and they work for you there's no need to update them. In fact, they may be more efficient: there are performance impacts related to the use of the si- commands, because they create slightly larger indexes than the "manual" method does."

Splunk Employee
Splunk Employee

Hmm. It's not always true that si generates large results. For example, for computing medians and percentiles, si will likely be considerably more efficient than whatever you come up with manually. However, there will also be cases where you can't use si commands to summarize and retrieve the data as you need.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!