Knowledge Management

Running a search for "All Time" using Summary Search Index

pmccomb
Explorer

I would like to run a search for time period = "All Time". The idea is to get a unique list of all users and user firms that have ever logged into a particular web site.

In order to have the search run more efficiently/quickly I think I should use a Summary Index.

How do I update the Summary Index so that it contains all data over all time in the past and then gets augmented periodically (say, hourly) as time moves forward and not overlap data sets or have time gaps?

Here is an example of may search:
sourcetype="Logins" message="User logged in" Userid NOT "*@internaluser.com" | sichart distinct_count(Userid)

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi pmccomb,

take a look at the docs about the fill_summary_index.py script, which can be used to add new event into summary index.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi pmccomb,

take a look at the docs about the fill_summary_index.py script, which can be used to add new event into summary index.

hope this helps ...

cheers, MuS

pmccomb
Explorer

Thanks. Yes. I think that will work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...