Using summary indexes as method to isolate development from production searching

[wgabree]

Wondering if setting up a Development Search Head that creates summary indexes by searching Production Indexers would isolate the Production Indexers from the searches performed on the Development Search Head.

And if so, can the summary index searches be real time searches so that the summary indexes are populated close to real time?

[yannK]

You can have something like :

search-head-A search in clusterA then save the results in an index that is local (not forwarding to the clusterA)
then search-head-B confifured to search in cluster B and on search-head-A. it will be able to have the summarized data from the clusterA.

[jtrucks]

If you mean to have any searches done on dev to not have a direct impact on production performance, then sure, that will work. However, there is still a performance hit on the prod indexer due to pulling that data from the buckets to supply the dev search head with raw results.

As for near real-time, you can run the search every minute if it completes the search in less than 60 seconds, yes. However, you can run a real-time search piped to collect into a summary index. As the docs at http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Collect state:

The collect command also works with all-time real-time searches.