Knowledge Management

how to reuse existing summary index data further

sumitnagal
Path Finder

We are reporting daily new user added in system. WE have recently moved to summary indexing and we are getting data. Now as we are moving forward, is there a way we can reuse existing summary index data and current reporting.
For example
We are adding 25 user daily, so for a month we have added 750 users. Now when I will move to next month is there a way I can reuse this data, such that when any time I want to know how many users logged in till date. I can add all months data (I have restriction not to keep more then 3 months data in hot storage) in my current months tally. Also I am reporting numbers for this month too.
Here is some query I am using.
index=summary search="test" |bin span=7d _time | dedup puserid | stats dc(puserid)

My search "test" is running hourly and giving me new users in terms of puserid.

Tags (1)
0 Karma

lpolo
Motivator

If your sampling rate is hourly, your summary index in a year will have a total number of samples equal to 24 samples_per_day * 365 = 8760 events. Your summary index should be able to handle this. So, I do not see any problem.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...