Set Scheduled Search

[abazgwa21cz]

I want to set a Schedule for my search to find the data sent by user in our system . This is my search to catch each user sent more 2GB 

I am used bin _time span=2h but maybe it not correct, it Incremental for every 2hours later. 
So how can I take a search mean who sent more 2GB data in each 2 hours ??
Many thanks !!!

[gcusello]

Hi @abazgwa21cz,

let me understand: whay do you want to accelerate your search, is it very slow?

in this case, you could schedue your search to run on a more short time period (so it uses less data and it's faster) then this scheduled search saves results in a summary index and you can search on the summary, having in this vary very high performances.

Ciao.

Giuseppe

[abazgwa21cz]

Thanks for your answer 
when i create alert from my search, it seem spam like this 

and it maybe accumulated with previous result
So i now i want to search in range each 2 hours, and export sum of data user sent in 2 hours
how can i fix this 

[gcusello]

Hi @abazgwa21cz,

sorry I wasn't clear, you have to add to the end of your search the command " | collect index=<your_summary_index>" (you have also to before creating te summary index) and schedule it e.g. every hour,

then you can run the search on the summary index.

You can find information about this at 

https://lantern.splunk.com/Splunk_Platform/Product_Tips/Cloud_Platform/Using_summary_indexing_to_acc...

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/Knowledge/Usesummaryindexing

Ciao.

Giuseppe