How to summary index with six month data?

[rubeniturrieta]

Hi everyone

I have Splunk 6.3 and I have an index with a year of data, until now.
Dashboards with this data is very, very slow, so I thought about summary indexing.

I want to have scorecards with six months of data, with summary index. Some searches are more recently (one day ago, for example).

I would like to have six months of data in the summary index, and every 30 minutes get new data for the index.

I followed the documentation, but I get confused, and something does not work for me. Can someone please help me on how to do this?

Here I have a quest for example, I tried. I ran once this Search.

orig_sourcetype="ips" OR ((index=main OR index=ironport_wsa) AND orig_sourcetype="cisco:wsa:squid") OR ((index=cisco_asa OR index=main ) AND orig_sourcetype="cisco:asa") | sitimechart count(eval(orig_sourcetype="ips")) as "Cisco IPS", count(eval(orig_sourcetype="cisco:wsa:squid")) as "Cisco WSA", count(eval(orig_sourcetype="cisco:asa")) as "Cisco ASA"

Best regards

[woodcock · Accepted solution]

You cannot get anywhere running this search outside of a schedule because it will not send to a summary index (unless you force it to using the collect command which is overcomplicated; just schedule it). You have to schedule the search (in your case have it run every 30 minutes) and then select "Summary Index" and tell it which summary index to use for the destination of these SI events. Then, once this has run at least once (you can run a backfill command to have it roll backwards through time to move data into the SI), you can run a search like this:

index=MyNewSummaryIndex | timechart count(eval(orig_sourcetype="ips")) as "Cisco IPS", count(eval(orig_sourcetype="cisco:wsa:squid")) as "Cisco WSA", count(eval(orig_sourcetype="cisco:asa")) as "Cisco ASA"

[rubeniturrieta]

Ok, thanks you woodcock