Splunk Search

Question regarding summary index with saved search

chinmayc469
Explorer

Hello,

I have created a saved search to populate summary index. I am running saved search for every 5 minutes.

What i want is, first time when the saved search runs, it should run with time range as all time.
And from the second time on wards, saved search should with time range as "last 5 mins" (ie, latest=now and earliest=last time when ss ran succesfully)

So that i will avoid duplicate of data in summary index.

How to achieve this?

Thanks in advance.

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Yep, run the first saved search manually then schedule it thereafter

0 Karma

chinmayc469
Explorer

how about in production machines? we will not have access to change once it is gone to production.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

I don't get what you're asking.. On your production servers, you should backfill against all-time then once your backfilled, you should set up a scheduled search which will populate your summary index going forward. I would also suggest using the python script to backfill. This gives you the ability to ignore data thats already been backfilled and you can run parallel backfills without duplicates

https://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Managesummaryindexgapsandoverlaps

0 Karma

pradeepkumarg
Influencer

The first all time search, you can probably run manually, there after, you should chose earliest and latest with little bit of padding. latest=now is not a good practice as you are not accounting for the delay in the raw data. You can do something like earliest=-8m@m latest=-3m@m so that you account for 180 seconds of delay depending on how busy your indexers and forwarders are.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...