Hello You all talented people out there,
May I request someone to please help me with a reference link or a video that explains well on usage and setting up Splunk Summary Indexes.
I tried finding but I don't find a very good detailed or properly explained reference anywhere.
I have 4 dashboards that I built which doesn't take a lot of data but using summary index we will be able to faster load it and less load on the server
Will I need to make changes to the queries used in the dashboard using it ? does it use your computer's hard disk when create a dedicated index, do we need to change the 'Index' details in our query with the one we will create for SI purpose...etc lot of questions better if I can get a step by step guide.
Thanks in advance
A summary index is no different from any other event index so you create and use SIs the same way you would any other event index. The user's hard disk (assuming there is one) is not used. Yes, you will have to change your dashboards to read from the SI. You also will need a scheduled search to populate/update the SI. See https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/Setupsummaryindexes and https://aditumpartners.com/what-is-summary-indexing/ for more information.
Had been very busy all this while. I am trying this link today but it gives me '404 Not found'
May I request you to help me with an alternate link please
Thanks, let me check and get back to you here if I have further questions, I feel hard time understanding 'splunk doc' pages so was more looking towards an easy guide or steps but let me give it a try again.
Any time you have difficulty understanding a Splunk docs page be sure to submit feedback on that page. The Docs team is very good about updating the documentation in response to user feedback.