Knowledge Management

How to summary index with six month data?

rubeniturrieta
Communicator

Hi everyone

I have Splunk 6.3 and I have an index with a year of data, until now.
Dashboards with this data is very, very slow, so I thought about summary indexing.

I want to have scorecards with six months of data, with summary index. Some searches are more recently (one day ago, for example).

I would like to have six months of data in the summary index, and every 30 minutes get new data for the index.

I followed the documentation, but I get confused, and something does not work for me. Can someone please help me on how to do this?

Here I have a quest for example, I tried. I ran once this Search.

orig_sourcetype="ips" OR ((index=main OR index=ironport_wsa) AND orig_sourcetype="cisco:wsa:squid") OR ((index=cisco_asa OR index=main ) AND orig_sourcetype="cisco:asa") | sitimechart count(eval(orig_sourcetype="ips")) as "Cisco IPS", count(eval(orig_sourcetype="cisco:wsa:squid")) as "Cisco WSA", count(eval(orig_sourcetype="cisco:asa")) as "Cisco ASA"

Best regards

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You cannot get anywhere running this search outside of a schedule because it will not send to a summary index (unless you force it to using the collect command which is overcomplicated; just schedule it). You have to schedule the search (in your case have it run every 30 minutes) and then select "Summary Index" and tell it which summary index to use for the destination of these SI events. Then, once this has run at least once (you can run a backfill command to have it roll backwards through time to move data into the SI), you can run a search like this:

index=MyNewSummaryIndex | timechart count(eval(orig_sourcetype="ips")) as "Cisco IPS", count(eval(orig_sourcetype="cisco:wsa:squid")) as "Cisco WSA", count(eval(orig_sourcetype="cisco:asa")) as "Cisco ASA"

View solution in original post

woodcock
Esteemed Legend

You cannot get anywhere running this search outside of a schedule because it will not send to a summary index (unless you force it to using the collect command which is overcomplicated; just schedule it). You have to schedule the search (in your case have it run every 30 minutes) and then select "Summary Index" and tell it which summary index to use for the destination of these SI events. Then, once this has run at least once (you can run a backfill command to have it roll backwards through time to move data into the SI), you can run a search like this:

index=MyNewSummaryIndex | timechart count(eval(orig_sourcetype="ips")) as "Cisco IPS", count(eval(orig_sourcetype="cisco:wsa:squid")) as "Cisco WSA", count(eval(orig_sourcetype="cisco:asa")) as "Cisco ASA"

rubeniturrieta
Communicator

Ok, thanks you woodcock

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...