Knowledge Management

Different ways of populating a summary index

Dark_Ichigo
Builder

I want to run a backfill script to populate my summary index, the backfill script runs everyday via a cron job.

Can this be done without a backfill script and just a scheduled saved search with summary indexing enabled in savedsearches.conf?

0 Karma
1 Solution

gooza
Communicator

What I do is create the saved search ,schedule it from now on and use the backfill only once with the earliest time I want ( use the -et ) and the latest (the -lt) is just before the time I started the schedule search, add the -j switch to speed things up with the Maximum number of concurrent searches to run ..and that is it I don't use the backfill again.
more on backfill

View solution in original post

gooza
Communicator

What I do is create the saved search ,schedule it from now on and use the backfill only once with the earliest time I want ( use the -et ) and the latest (the -lt) is just before the time I started the schedule search, add the -j switch to speed things up with the Maximum number of concurrent searches to run ..and that is it I don't use the backfill again.
more on backfill

Dark_Ichigo
Builder

Yes, but it doesnt explain how you actually use it, but how you configure it to be able to be used.

Is there an example of it being used?

0 Karma

gooza
Communicator

do you mean:
enabling-real-time-backfill

more can be found on :

Real-time_backfill

0 Karma

Dark_Ichigo
Builder

Awesome!!, Although I wish there was a way I could set up a schedule search to run in realtime as in have a search continue-sly populating a summary index.

Anyways Thanks gooza

0 Karma

gooza
Communicator

Yes , just make sure you mark the "Enable summary indexing" when you schedule the saved search

Setting up summary index searches in splunk web

0 Karma

Dark_Ichigo
Builder

When you schedule the saved search, does it populate the summary index when it runs when setting Cron?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...