Knowledge Management

Using summary index by default in app?

erydberg
Splunk Employee
Splunk Employee

I'm writing an app that I know will index loads of data and then do some calculations on changes from day to day. To make my dashboards and reports faster I want to include saved searches that put data into a summary index. What is the best practice on this? The docs imply that all summary indexes needs to be configured via the ui, which will put the saved searches in local/, does that mean that you're not supposed to have summary indexes in apps by default?

http://www.splunk.com/base/Documentation/4.1.2/Knowledge/Configuresummaryindexes

Thanks

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

The docs may give that impression but no it's quite common for apps to have preconfigured summary indexing searches. The windows app is a common example - it runs a search called win_eventlog_count_sum_index and you'll see the relevant stanza has summary indexing going on, and it's just sitting in the app's default directory.

I think some app developers have success using the manager UI to create and edit items destined for an app, and then they use the manager UI to 'move' the items up into the app space. Possibly there's some final merging of the app/local into app/default, im not sure.

And other crustier app developers just bypass the UI and manually create and edit the app's default config on disk, refreshing changes by either hitting the refresh endpoint or restarting the server.

View solution in original post

sideview
SplunkTrust
SplunkTrust

The docs may give that impression but no it's quite common for apps to have preconfigured summary indexing searches. The windows app is a common example - it runs a search called win_eventlog_count_sum_index and you'll see the relevant stanza has summary indexing going on, and it's just sitting in the app's default directory.

I think some app developers have success using the manager UI to create and edit items destined for an app, and then they use the manager UI to 'move' the items up into the app space. Possibly there's some final merging of the app/local into app/default, im not sure.

And other crustier app developers just bypass the UI and manually create and edit the app's default config on disk, refreshing changes by either hitting the refresh endpoint or restarting the server.

piebob
Motivator

yeah, the doc was written with end users in mind more than developers. we'll add some information explaining the available options for developers.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...