Knowledge Management

How to summary index with six month data?

rubeniturrieta
Communicator

Hi everyone

I have Splunk 6.3 and I have an index with a year of data, until now.
Dashboards with this data is very, very slow, so I thought about summary indexing.

I want to have scorecards with six months of data, with summary index. Some searches are more recently (one day ago, for example).

I would like to have six months of data in the summary index, and every 30 minutes get new data for the index.

I followed the documentation, but I get confused, and something does not work for me. Can someone please help me on how to do this?

Here I have a quest for example, I tried. I ran once this Search.

orig_sourcetype="ips" OR ((index=main OR index=ironport_wsa) AND orig_sourcetype="cisco:wsa:squid") OR ((index=cisco_asa OR index=main ) AND orig_sourcetype="cisco:asa") | sitimechart count(eval(orig_sourcetype="ips")) as "Cisco IPS", count(eval(orig_sourcetype="cisco:wsa:squid")) as "Cisco WSA", count(eval(orig_sourcetype="cisco:asa")) as "Cisco ASA"

Best regards

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You cannot get anywhere running this search outside of a schedule because it will not send to a summary index (unless you force it to using the collect command which is overcomplicated; just schedule it). You have to schedule the search (in your case have it run every 30 minutes) and then select "Summary Index" and tell it which summary index to use for the destination of these SI events. Then, once this has run at least once (you can run a backfill command to have it roll backwards through time to move data into the SI), you can run a search like this:

index=MyNewSummaryIndex | timechart count(eval(orig_sourcetype="ips")) as "Cisco IPS", count(eval(orig_sourcetype="cisco:wsa:squid")) as "Cisco WSA", count(eval(orig_sourcetype="cisco:asa")) as "Cisco ASA"

View solution in original post

woodcock
Esteemed Legend

You cannot get anywhere running this search outside of a schedule because it will not send to a summary index (unless you force it to using the collect command which is overcomplicated; just schedule it). You have to schedule the search (in your case have it run every 30 minutes) and then select "Summary Index" and tell it which summary index to use for the destination of these SI events. Then, once this has run at least once (you can run a backfill command to have it roll backwards through time to move data into the SI), you can run a search like this:

index=MyNewSummaryIndex | timechart count(eval(orig_sourcetype="ips")) as "Cisco IPS", count(eval(orig_sourcetype="cisco:wsa:squid")) as "Cisco WSA", count(eval(orig_sourcetype="cisco:asa")) as "Cisco ASA"

rubeniturrieta
Communicator

Ok, thanks you woodcock

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...