Splunk Enterprise Security

Steby by Step Guide to use and build 'Summary Index'

beriwalnishant
Explorer

Hello You all talented people out there,

 

May I request someone to please help me with a reference link or a video that explains well on usage and setting up Splunk Summary Indexes.

I tried finding but I don't find a very good detailed or properly explained reference anywhere.

I have 4 dashboards that I built which doesn't take a lot of data but using summary index we will be able to faster load it and less load on the server

Will I need to make changes to the queries used in the dashboard using it ?  does it use your computer's hard disk when create a dedicated index, do we need to change the 'Index' details in our query with the one we will create for SI purpose...etc  lot of questions better if I can get a step by step guide.

 

Thanks in advance

Nishant

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The 404 page on that site has a search box which makes finding pages trivial.  Try https://www.sp6.io/blog/what-is-summary-indexing/

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

A summary index is no different from any other event index so you create and use SIs the same way you would any other event index.  The user's hard disk (assuming there is one) is not used.  Yes, you will have to change your dashboards to read from the SI.  You also will need a scheduled search to populate/update the SI.  See https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/Setupsummaryindexes and https://aditumpartners.com/what-is-summary-indexing/ for more information.

---
If this reply helps you, an upvote would be appreciated.

beriwalnishant
Explorer

Hey Rich,

Had been very busy all this while.  I am trying this link today but it gives me '404 Not found'

 

https://aditumpartners.com/what-is-summary-indexing/ 

 

May I request you to help me with an alternate link please

 

NIshant

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The 404 page on that site has a search box which makes finding pages trivial.  Try https://www.sp6.io/blog/what-is-summary-indexing/

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

beriwalnishant
Explorer

Thanks, let me check and get back to you here if I have further questions, I feel hard time understanding 'splunk doc' pages so was more looking towards an easy guide or steps but let me give it a try again.

 

Nishant

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Any time you have difficulty understanding a Splunk docs page be sure to submit feedback on that page.  The Docs team is very good about updating the documentation in response to user feedback.

---
If this reply helps you, an upvote would be appreciated.

beriwalnishant
Explorer

Super thanks a lot

0 Karma

beriwalnishant
Explorer

Understood thanks for advising.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!