Knowledge Management

Different ways of populating a summary index

Dark_Ichigo
Builder

I want to run a backfill script to populate my summary index, the backfill script runs everyday via a cron job.

Can this be done without a backfill script and just a scheduled saved search with summary indexing enabled in savedsearches.conf?

0 Karma
1 Solution

gooza
Communicator

What I do is create the saved search ,schedule it from now on and use the backfill only once with the earliest time I want ( use the -et ) and the latest (the -lt) is just before the time I started the schedule search, add the -j switch to speed things up with the Maximum number of concurrent searches to run ..and that is it I don't use the backfill again.
more on backfill

View solution in original post

gooza
Communicator

What I do is create the saved search ,schedule it from now on and use the backfill only once with the earliest time I want ( use the -et ) and the latest (the -lt) is just before the time I started the schedule search, add the -j switch to speed things up with the Maximum number of concurrent searches to run ..and that is it I don't use the backfill again.
more on backfill

Dark_Ichigo
Builder

Yes, but it doesnt explain how you actually use it, but how you configure it to be able to be used.

Is there an example of it being used?

0 Karma

gooza
Communicator

do you mean:
enabling-real-time-backfill

more can be found on :

Real-time_backfill

0 Karma

Dark_Ichigo
Builder

Awesome!!, Although I wish there was a way I could set up a schedule search to run in realtime as in have a search continue-sly populating a summary index.

Anyways Thanks gooza

0 Karma

gooza
Communicator

Yes , just make sure you mark the "Enable summary indexing" when you schedule the saved search

Setting up summary index searches in splunk web

0 Karma

Dark_Ichigo
Builder

When you schedule the saved search, does it populate the summary index when it runs when setting Cron?

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...