Knowledge Management

Are there summary index naming convention standards?

Path Finder

So I need to set up a summary index for our reporting team to do our monthly reports. Are there any naming conventions that I need to abide by?

If I name the index "report" or "report_summary", does it matter? Does the name matter when counting against your license? Are events in summary indexes exempt from your license count? How are summary events not counted towards your license?

1 Solution

SplunkTrust
SplunkTrust

I typically add "DO NOT CLICK" as the prefix of the report name so I accidentally don't click it and run another populating search.. Also make sure the permissions are set to private so other users cant run the populating search.

The only thing that will count against your licenses is if you index more data, so "reindexing" your data which was already indexed will not count against your licenses, so your safe to run as many summary indexes as you wish.

View solution in original post

Communicator

You can use the guideline documented in:
https://docs.splunk.com/Documentation/CoE/current/Handbook/Naming

For summary index use:
companyname_purpose_sensitivity_summary naming convention

Example: acme_report_prod_summary
or
yourcompanyname_report_dev_summary

SplunkTrust
SplunkTrust

I typically add "DO NOT CLICK" as the prefix of the report name so I accidentally don't click it and run another populating search.. Also make sure the permissions are set to private so other users cant run the populating search.

The only thing that will count against your licenses is if you index more data, so "reindexing" your data which was already indexed will not count against your licenses, so your safe to run as many summary indexes as you wish.

View solution in original post

Esteemed Legend

HA! You got that from me! 😆 I am glad to see that it has worked all those years!

SplunkTrust
SplunkTrust

Yes I did!

Naming convention is everything, especially when scaling

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!