Knowledge Management

Different ways of populating a summary index

Builder

I want to run a backfill script to populate my summary index, the backfill script runs everyday via a cron job.

Can this be done without a backfill script and just a scheduled saved search with summary indexing enabled in savedsearches.conf?

0 Karma
1 Solution

Communicator

What I do is create the saved search ,schedule it from now on and use the backfill only once with the earliest time I want ( use the -et ) and the latest (the -lt) is just before the time I started the schedule search, add the -j switch to speed things up with the Maximum number of concurrent searches to run ..and that is it I don't use the backfill again.
more on backfill

View solution in original post

Communicator

What I do is create the saved search ,schedule it from now on and use the backfill only once with the earliest time I want ( use the -et ) and the latest (the -lt) is just before the time I started the schedule search, add the -j switch to speed things up with the Maximum number of concurrent searches to run ..and that is it I don't use the backfill again.
more on backfill

View solution in original post

Builder

Yes, but it doesnt explain how you actually use it, but how you configure it to be able to be used.

Is there an example of it being used?

0 Karma

Communicator

do you mean:
enabling-real-time-backfill

more can be found on :

Real-time_backfill

0 Karma

Builder

Awesome!!, Although I wish there was a way I could set up a schedule search to run in realtime as in have a search continue-sly populating a summary index.

Anyways Thanks gooza

0 Karma

Communicator

Yes , just make sure you mark the "Enable summary indexing" when you schedule the saved search

Setting up summary index searches in splunk web

0 Karma

Builder

When you schedule the saved search, does it populate the summary index when it runs when setting Cron?

0 Karma