Different ways of populating a summary index

[Dark_Ichigo]

I want to run a backfill script to populate my summary index, the backfill script runs everyday via a cron job.

Can this be done without a backfill script and just a scheduled saved search with summary indexing enabled in savedsearches.conf?

[gooza · Accepted solution]

What I do is create the saved search ,schedule it from now on and use the backfill only once with the earliest time I want ( use the -et ) and the latest (the -lt) is just before the time I started the schedule search, add the -j switch to speed things up with the Maximum number of concurrent searches to run ..and that is it I don't use the backfill again.
more on backfill

[Dark_Ichigo]

Yes, but it doesnt explain how you actually use it, but how you configure it to be able to be used.

Is there an example of it being used?

[gooza]

do you mean:
enabling-real-time-backfill

more can be found on :

Real-time_backfill

[Dark_Ichigo]

Awesome!!, Although I wish there was a way I could set up a schedule search to run in realtime as in have a search continue-sly populating a summary index.

Anyways Thanks gooza

[gooza]

Yes , just make sure you mark the "Enable summary indexing" when you schedule the saved search

Setting up summary index searches in splunk web

[Dark_Ichigo]

When you schedule the saved search, does it populate the summary index when it runs when setting Cron?