Knowledge Management

Using summary index by default in app?

erydberg
Splunk Employee
Splunk Employee

I'm writing an app that I know will index loads of data and then do some calculations on changes from day to day. To make my dashboards and reports faster I want to include saved searches that put data into a summary index. What is the best practice on this? The docs imply that all summary indexes needs to be configured via the ui, which will put the saved searches in local/, does that mean that you're not supposed to have summary indexes in apps by default?

http://www.splunk.com/base/Documentation/4.1.2/Knowledge/Configuresummaryindexes

Thanks

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

The docs may give that impression but no it's quite common for apps to have preconfigured summary indexing searches. The windows app is a common example - it runs a search called win_eventlog_count_sum_index and you'll see the relevant stanza has summary indexing going on, and it's just sitting in the app's default directory.

I think some app developers have success using the manager UI to create and edit items destined for an app, and then they use the manager UI to 'move' the items up into the app space. Possibly there's some final merging of the app/local into app/default, im not sure.

And other crustier app developers just bypass the UI and manually create and edit the app's default config on disk, refreshing changes by either hitting the refresh endpoint or restarting the server.

View solution in original post

sideview
SplunkTrust
SplunkTrust

The docs may give that impression but no it's quite common for apps to have preconfigured summary indexing searches. The windows app is a common example - it runs a search called win_eventlog_count_sum_index and you'll see the relevant stanza has summary indexing going on, and it's just sitting in the app's default directory.

I think some app developers have success using the manager UI to create and edit items destined for an app, and then they use the manager UI to 'move' the items up into the app space. Possibly there's some final merging of the app/local into app/default, im not sure.

And other crustier app developers just bypass the UI and manually create and edit the app's default config on disk, refreshing changes by either hitting the refresh endpoint or restarting the server.

piebob
Splunk Employee
Splunk Employee

yeah, the doc was written with end users in mind more than developers. we'll add some information explaining the available options for developers.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...