Splunk Search

How to get search results for last week's data without re-running the search?

guruwells
Explorer

Hi All,

On a daily basis, I am running one search to get results in a table representation format. I wanted to see the results for the last week's data without re-running the search. What is the best way to do this?

Suggestions will be appreciated.

Thanks,
Guru Prasad K.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

You can use summary indexing to store week's data and search summary index to avoid large searches on real indexes

Reference : http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Usesummaryindexing

If you do not want to do search at all then probably use savedsearches and persist data on the disk and loadjob can be used to bring back the results. However, saved searches will only be persisted until your quota settings rotate out the old searches based on the period settings.

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You can use summary indexing to store week's data and search summary index to avoid large searches on real indexes

Reference : http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Usesummaryindexing

If you do not want to do search at all then probably use savedsearches and persist data on the disk and loadjob can be used to bring back the results. However, saved searches will only be persisted until your quota settings rotate out the old searches based on the period settings.

Happy Splunking!
0 Karma

guruwells
Explorer

Hi,
Thanks for the mail. I have checked your answer, it's quite useful. I have gone through that. Can you please provide some example query, how to retrieve summary index data of last week something.

I am looking data about last week . Something like below.
17/06/2016 users average
18/06/2016 20 10
19/06/2016 30 20
20/06/2016 40 30.

Note: I have created report and saved. Scheduled on daily basis and enabled summary index as well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...