Splunk Search

Summary Indexing and Send data back to Indexers

nikhilmehra79
Path Finder

Hi,

I have build a dedicated Search head for running scheduled search and get summary indexing data, now i think it is recommended to send the summary indexed data back to indexers.How do we do this?

I have build a new index of 50 MB on this dedicated search head called si_summary. This is getting populated on this search head , but it never created same si_summary on my 2 indexers automatically.
So i manually created si_summary on 2 indexers but they still not populated with any data...any idea i am doing anything wrong. I am assuming job of summary indexer search head is to save summary data but that should not be stored on search head rather should be passed to indexer correct?

0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

You will need to have an outputs.conf on your search head, to let it know where to forward data:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Outputsconf

View solution in original post

sbrant_splunk
Splunk Employee
Splunk Employee

You will need to have an outputs.conf on your search head, to let it know where to forward data:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Outputsconf

somesoni2
SplunkTrust
SplunkTrust

You should've include the Summary index search head as part of your distributed deployment, so that it will directly save the summary index data onto Indexers.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...