How to build a Splunk alert/report using summary index?

[joachimroshan]

Currently I am running the below query to generate a report based on appname,spacename,orgnameand foundation which takes longer to run(for the past 24 hours search). How do I create a summary index to efficiently use this query for faster results?

sourcetype="pcf:log"
| eval report_create_time=strftime(now(), "%Y-%m-%d %H:%M:%S,%3N")
| eval spanID_ = coalesce(span_id, SPAN_ID, x_b3_spanid, spanId)
|stats count(spanID_) AS spanCount by report_create_time cf_app_name, cf_space_name, cf_org_name, foundation

[HiroshiSatoh]

Populating the summary index with data is easy.

(your search)| collect index=your_summary_index

However, it does not mean faster with data.It is only faster because the search is performed periodically and the results are created in advance.
There are disadvantages such as the need to recover manually if the regular execution fails.

It's a good idea to compare the pros and cons with "Accelerate reports".

I think it's better to "Accelerate reports" that can automatically recover from missing teeth.
https://docs.splunk.com/Documentation/Splunk/8.0.2/Report/Acceleratereports