Enabling summary indexing for existing saved reports

[andrewdotnich]

I have roughly 30 saved reports that aggregate data over largish periods of time, and I've just discovered the summary indexing features. Is there an easy way for me to quickly enable summary indexing for each of these reports, or will I have to go and do it manually for each one?

[Lowell · Accepted solution]

You'll have to do it for each search manually. Splunk does allow for for some automation using REST API, but there's no way it would be worth the effort for just 30 saved searches. You may find editing the savedsearches.conf to be a faster approach that going through the UI.

That said, I really don't think you want to do what your asking....

You never really just "enable" summary indexing for a search, you first create a search that will populate the summary index, and then a second one that does a search on those generated summary index events. This isn't overly complicated, but based on how you've asked the question, I'm guessing you may be thinking that this is simpler than it really is.

Also, It's normally a good idea to review and cleanup your saved searches before you convert them into summary indexing searches. You may find some overlap in events. For example, you could find 2-3 searches that all go against the same basic sets of events, and could therefore be summarized by a single search, instead of requiring 3 individual summary saved searches.

The bottom line is that I would recommend that you try summary indexing on a few searches on a case-by-case basis. Start with your slowest searches, searches that go across the largest timeframes or process need to look at the most events. Play around with summarizing for those situations, and then go from there.

This video is a bit old, but the core concepts are the same:

http://www.splunk.com/view/SP-CAAACZW

Note that the si* prefixed search commands were added much after this video was created, and using them can make summary indexing easier. Also, snap-back time ranges were added after this time too; they also are a great help.