Splunk Search

How to schedule daily summary indexing with a search that uses the geostats command? Is there another approach?

cheinlein
Engager

My search is simple:

sourcetype=log_data | iplocation c_ip | geostats latfield=lat longfield=lon count

but I have a lot of data, about 100,000,000 logs a day, and the customer wants a monthly summary. A monthly search would be too slow. I'd like to be able to write a daily summary and schedule it, but there is no summary indexing for the geostats command. (sigeostats ). Ideas on another way to approach this?

0 Karma

knielsen
Contributor

You don't need the si commands at all to populate a summary index. Your search works fine as a daily search for that. Well, it depends on what you do with the data later on. I have about 200 summary indexes in place, I never even tried the si commands, they are all built by searches using stats.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...