Splunk Search

How to get search results for last week's data without re-running the search?

Explorer

Hi All,

On a daily basis, I am running one search to get results in a table representation format. I wanted to see the results for the last week's data without re-running the search. What is the best way to do this?

Suggestions will be appreciated.

Thanks,
Guru Prasad K.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can use summary indexing to store week's data and search summary index to avoid large searches on real indexes

Reference : http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Usesummaryindexing

If you do not want to do search at all then probably use savedsearches and persist data on the disk and loadjob can be used to bring back the results. However, saved searches will only be persisted until your quota settings rotate out the old searches based on the period settings.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You can use summary indexing to store week's data and search summary index to avoid large searches on real indexes

Reference : http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Usesummaryindexing

If you do not want to do search at all then probably use savedsearches and persist data on the disk and loadjob can be used to bring back the results. However, saved searches will only be persisted until your quota settings rotate out the old searches based on the period settings.

View solution in original post

0 Karma

Explorer

Hi,
Thanks for the mail. I have checked your answer, it's quite useful. I have gone through that. Can you please provide some example query, how to retrieve summary index data of last week something.

I am looking data about last week . Something like below.
17/06/2016 users average
18/06/2016 20 10
19/06/2016 30 20
20/06/2016 40 30.

Note: I have created report and saved. Scheduled on daily basis and enabled summary index as well.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!