how to initially setup a summary index ?

[Skins]

I have a report which is sloooow - seems like a good candidate for summary index. reading the docs it suggests configuring a saved search to run on an hourly basis to populate the previous hours data.

This dashboard panel will then show a months web transactions.

but how to set this up initially .. should i create a scheduled saved search to initially run over a month timeframe to initially populate the summary index - and then reconfigure to run hourly - or what ?

gratzi.

[deepashri_123]

Hey Skins,

You can check following approaches for faster reports:
1. LoadJob:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Loadjob
2. You can also use accelerated data models:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels
3. Scheduled Report
http://docs.splunk.com/Documentation/Splunk/latest/Report/Schedulereports
4. Summary indexing.
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing

Let me know if this helps!!

[somesoni2]

You would schedule it to run per your desired frequency, i.e. Hourly, to summary index data from now on. Then you would backfill the summary index for the desired duration, constrain by amount of raw data you've available. The backfill process can be found here:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Managesummaryindexgapsandoverlaps

The backfill can only be done for period you've actual/raw data available. The backfill period should be just before you scheduled it run.

[ddrillic]

Before you embark on a summary index journey, please consider report acceleration as it's a simpler feature and Splunk tries to stir us in this direction.

[Skins]

gratzi - accelerated the report and it gave me exactly what i was looking for.

[paulbannister]

Hi There,

Short answer would be... both

Slightly longer answer depends of whether you want any historical data to work with/how long it will take to run the search over a months worth of data, or if you're happy to just populate with data from the time you click go

I'm assuming you've done everything you can to optimise the search you have, if that's the case then summary index is definitely the way to go