How to get search results for last week's data without re-running the search?

[guruwells]

Hi All,

On a daily basis, I am running one search to get results in a table representation format. I wanted to see the results for the last week's data without re-running the search. What is the best way to do this?

Suggestions will be appreciated.

Thanks,
Guru Prasad K.

[renjith_nair · Accepted solution]

You can use summary indexing to store week's data and search summary index to avoid large searches on real indexes

Reference : http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Usesummaryindexing

If you do not want to do search at all then probably use savedsearches and persist data on the disk and loadjob can be used to bring back the results. However, saved searches will only be persisted until your quota settings rotate out the old searches based on the period settings.

[guruwells]

Hi,
Thanks for the mail. I have checked your answer, it's quite useful. I have gone through that. Can you please provide some example query, how to retrieve summary index data of last week something.

I am looking data about last week . Something like below.
17/06/2016 users average
18/06/2016 20 10
19/06/2016 30 20
20/06/2016 40 30.

Note: I have created report and saved. Scheduled on daily basis and enabled summary index as well.