Knowledge Management

How to build a Splunk alert/report using summary index?

joachimroshan
New Member

Currently I am running the below query to generate a report based on appname,spacename,orgnameand foundation which takes longer to run(for the past 24 hours search). How do I create a summary index to efficiently use this query for faster results?

sourcetype="pcf:log"
| eval report_create_time=strftime(now(), "%Y-%m-%d %H:%M:%S,%3N")
| eval spanID_ = coalesce(span_id, SPAN_ID, x_b3_spanid, spanId)
|stats count(spanID_) AS spanCount by report_create_time cf_app_name, cf_space_name, cf_org_name, foundation

Labels (1)
Tags (1)
0 Karma

HiroshiSatoh
Champion

Populating the summary index with data is easy.

(your search)| collect index=your_summary_index

However, it does not mean faster with data.It is only faster because the search is performed periodically and the results are created in advance.
There are disadvantages such as the need to recover manually if the regular execution fails.

It's a good idea to compare the pros and cons with "Accelerate reports".

I think it's better to "Accelerate reports" that can automatically recover from missing teeth.
https://docs.splunk.com/Documentation/Splunk/8.0.2/Report/Acceleratereports

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!