Can summaryindexes, aka stash files, be stored somewhere other than $SPLUNK_HOME/var/spool/splunk/_.stash? Specifically, can the $SPLUNK_HOME part be changed?
Disk space is the issue. I have a...
I want to be able to use the search GUI to create summaryindex searches, but i want the actual resulting summaryindex to live on my distributed indexers. how can i accomplish this?
...hat I would like to do is configure the saved searches that write to a summaryindex on the search head and write summary data to summaryindexes on the indexers where i search.
Is this possible/the r...
...ome searches and store the results by enabling summaryindex at rpp_pe_summary_idx_dmc. Question here is we need to update the indexes.conf to meet below requirements.
Hot&Warm buckets will h...
Hi
I need to run a series of summary generating searches, one followed by another.
e.g.
summary search1 generates summary data from raw, and stores the summary data in summaryindex1
summary...
...esult, Question: How to create the summaryindex based on above query? I found that all the summaryindex command are below 5 si commands per this official document h...
I am trying to build a summaryindex to pull a week over week comparison of specific applications. The below query works normally, but for efficiency reasons I would like to place this in a summaryindex...
Good day!
May i ask you guys a favor can you tell us on how we can use Summaryindexing or how to configure it? i have already seen the document about summaryindexing but i'm still didn't u...
In the documentation about using summaryindexes it says at step 8:
Select a summaryindex. The default
summaryindex is named summary. The
list only displays indexes to which
you have p...