Knowledge Management

How to summary index with six month data?

rubeniturrieta
Communicator

Hi everyone

I have Splunk 6.3 and I have an index with a year of data, until now.
Dashboards with this data is very, very slow, so I thought about summary indexing.

I want to have scorecards with six months of data, with summary index. Some searches are more recently (one day ago, for example).

I would like to have six months of data in the summary index, and every 30 minutes get new data for the index.

I followed the documentation, but I get confused, and something does not work for me. Can someone please help me on how to do this?

Here I have a quest for example, I tried. I ran once this Search.

orig_sourcetype="ips" OR ((index=main OR index=ironport_wsa) AND orig_sourcetype="cisco:wsa:squid") OR ((index=cisco_asa OR index=main ) AND orig_sourcetype="cisco:asa") | sitimechart count(eval(orig_sourcetype="ips")) as "Cisco IPS", count(eval(orig_sourcetype="cisco:wsa:squid")) as "Cisco WSA", count(eval(orig_sourcetype="cisco:asa")) as "Cisco ASA"

Best regards

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You cannot get anywhere running this search outside of a schedule because it will not send to a summary index (unless you force it to using the collect command which is overcomplicated; just schedule it). You have to schedule the search (in your case have it run every 30 minutes) and then select "Summary Index" and tell it which summary index to use for the destination of these SI events. Then, once this has run at least once (you can run a backfill command to have it roll backwards through time to move data into the SI), you can run a search like this:

index=MyNewSummaryIndex | timechart count(eval(orig_sourcetype="ips")) as "Cisco IPS", count(eval(orig_sourcetype="cisco:wsa:squid")) as "Cisco WSA", count(eval(orig_sourcetype="cisco:asa")) as "Cisco ASA"

View solution in original post

woodcock
Esteemed Legend

You cannot get anywhere running this search outside of a schedule because it will not send to a summary index (unless you force it to using the collect command which is overcomplicated; just schedule it). You have to schedule the search (in your case have it run every 30 minutes) and then select "Summary Index" and tell it which summary index to use for the destination of these SI events. Then, once this has run at least once (you can run a backfill command to have it roll backwards through time to move data into the SI), you can run a search like this:

index=MyNewSummaryIndex | timechart count(eval(orig_sourcetype="ips")) as "Cisco IPS", count(eval(orig_sourcetype="cisco:wsa:squid")) as "Cisco WSA", count(eval(orig_sourcetype="cisco:asa")) as "Cisco ASA"

rubeniturrieta
Communicator

Ok, thanks you woodcock

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...