Knowledge Management

Using summary indexes as method to isolate development from production searching

wgabree
Engager

Wondering if setting up a Development Search Head that creates summary indexes by searching Production Indexers would isolate the Production Indexers from the searches performed on the Development Search Head.

And if so, can the summary index searches be real time searches so that the summary indexes are populated close to real time?

Tags (1)

yannK
Splunk Employee
Splunk Employee

You can have something like :

search-head-A search in clusterA then save the results in an index that is local (not forwarding to the clusterA)
then search-head-B confifured to search in cluster B and on search-head-A. it will be able to have the summarized data from the clusterA.

0 Karma

jtrucks
Splunk Employee
Splunk Employee

If you mean to have any searches done on dev to not have a direct impact on production performance, then sure, that will work. However, there is still a performance hit on the prod indexer due to pulling that data from the buckets to supply the dev search head with raw results.

As for near real-time, you can run the search every minute if it completes the search in less than 60 seconds, yes. However, you can run a real-time search piped to collect into a summary index. As the docs at http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Collect state:

The collect command also works with all-time real-time searches.

--
Jesse Trucks
Minister of Magic
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...