Splunk Search
Highlighted

Email the Scheduled Search Result

Engager

Hi, I have a search scheduled to run at a given time and alert condition to email to my colleague. When my colleague received and opened the link the search would still load and not show the result right away. I think this is kinda odd since this save search was scheduled to run so it must have already the result.

Tags (2)
0 Karma
Highlighted

Re: Email the Scheduled Search Result

Communicator

You might try using "Summary Indexing". From the man page "Use summary indexing to efficiently report on large volumes of data. With summary indexing, you set up a search that extracts the precise information you want, on a frequent basis. Each time Splunk runs this search it saves the results into a summary index that you designate. You can then run searches and reports on this significantly smaller (and thus seemingly "faster") summary index."

0 Karma