Knowledge Management

How to build a Splunk alert/report using summary index?

joachimroshan
New Member

Currently I am running the below query to generate a report based on appname,spacename,orgnameand foundation which takes longer to run(for the past 24 hours search). How do I create a summary index to efficiently use this query for faster results?

sourcetype="pcf:log"
| eval report_create_time=strftime(now(), "%Y-%m-%d %H:%M:%S,%3N")
| eval spanID_ = coalesce(span_id, SPAN_ID, x_b3_spanid, spanId)
|stats count(spanID_) AS spanCount by report_create_time cf_app_name, cf_space_name, cf_org_name, foundation

Labels (1)
Tags (1)
0 Karma

HiroshiSatoh
Champion

Populating the summary index with data is easy.

(your search)| collect index=your_summary_index

However, it does not mean faster with data.It is only faster because the search is performed periodically and the results are created in advance.
There are disadvantages such as the need to recover manually if the regular execution fails.

It's a good idea to compare the pros and cons with "Accelerate reports".

I think it's better to "Accelerate reports" that can automatically recover from missing teeth.
https://docs.splunk.com/Documentation/Splunk/8.0.2/Report/Acceleratereports

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...