Steby by Step Guide to use and build 'Summary Index'

[beriwalnishant]

Hello You all talented people out there,

May I request someone to please help me with a reference link or a video that explains well on usage and setting up Splunk Summary Indexes.

I tried finding but I don't find a very good detailed or properly explained reference anywhere.

I have 4 dashboards that I built which doesn't take a lot of data but using summary index we will be able to faster load it and less load on the server

Will I need to make changes to the queries used in the dashboard using it ?  does it use your computer's hard disk when create a dedicated index, do we need to change the 'Index' details in our query with the one we will create for SI purpose...etc  lot of questions better if I can get a step by step guide.

Thanks in advance

Nishant

[richgalloway]

A summary index is no different from any other event index so you create and use SIs the same way you would any other event index.  The user's hard disk (assuming there is one) is not used.  Yes, you will have to change your dashboards to read from the SI.  You also will need a scheduled search to populate/update the SI.  See https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/Setupsummaryindexes and https://aditumpartners.com/what-is-summary-indexing/ for more information.

[beriwalnishant]

Hey Rich,

Had been very busy all this while.  I am trying this link today but it gives me '404 Not found'

https://aditumpartners.com/what-is-summary-indexing/ 

May I request you to help me with an alternate link please

NIshant

[richgalloway · Accepted solution]

The 404 page on that site has a search box which makes finding pages trivial.  Try https://www.sp6.io/blog/what-is-summary-indexing/

[beriwalnishant]

Thanks, let me check and get back to you here if I have further questions, I feel hard time understanding 'splunk doc' pages so was more looking towards an easy guide or steps but let me give it a try again.

Nishant

[richgalloway]

Any time you have difficulty understanding a Splunk docs page be sure to submit feedback on that page.  The Docs team is very good about updating the documentation in response to user feedback.

[beriwalnishant]

Super thanks a lot

[beriwalnishant]

Understood thanks for advising.