Knowledge Management

How to edit my search to create a summary index?

jihoon
New Member

I am trying to make a summary index for data in April 2014.

Using the current default search and joins, and to query more than 25 GB of data takes more than 35 seconds of time.

I want to use a summary index to reduce the amount of time used in the search.

index=mail-bak sourcetype=MiMailData earliest="04/01/2014:00:00:00" latest="04/30/2014:24:00:00" MailType=0 OR MailType=1 OR MailType=2 | where isnull(MailCc)
| join MailUID [search index=vpn sourcetype=accesslog earliest="05/01/2014:00:00:00" latest="05/01/2014:24:00:00" | stats count as VpnAccessCount by USER_ID | eval MailUID = USER_ID ] 
| eval testYn = if( match( MailTo , MailFrom ), "Y", "N")
| eval testYn2 = if( match( MailTo , ","), "Y", "N") | search testYn = "Y" AND testYn2 = "N" 
| stats count as SendWeekCount by MailUID VpnAccessCount | rename MailUID as MailTo
| table MailTo SendWeekCount VpnAccessCount

Where's the part that is included in the search command?

What time zone settings?

In addition to setting the part?

Answer please. Thank you.

Tags (1)
0 Karma

masonmorales
Influencer

I think this is what you are looking for:

http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect

You add "| collect index="mysummaryindex" to the end of your search.

Time zone is the server's time zone by default. This is often GMT but you can do index=* | head 1 | table _time and compare it to your current (local) time to find out.

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Have you evaluated report acceleration vs. summary indexing? See Overview of summary-based search and pivot acceleration in the Knowledge Manager Manual for more information.

For instructions about the reporting commands that populate a summary index, such as sistats, as well as other background information you can use to determine whether a summary index is what you need, see Use summary indexing for increased reporting efficiency, also in the Knowledge Manager Manual.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...