Reporting

How to schedule a summary index where the base search look back time is greater than the scheduled report time and not create duplicates?

Glasses
Contributor

Hi
I have a data source that does not roll in on a consistent near-real-time schedule.
I need to send the events to a summary index which feeds another application.
I want to schedule the base search (for the summary index) to run every 15 minutes and look back at the last 30 minutes.
I am not having luck with my syntax and not getting the result I want. I am getting duplicates which I don't want in the summary index.

Any recommendations would be appreciated.

Thank you,
Gunnar

0 Karma

jacobpevans
Motivator

Greetings @Glasses,

There are commands for the sole purpose of properly populating summary indexes:

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.