O'Reilly logo

Implementing Splunk - Second Edition by James D Miller, Vincent Bumgarner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Populating summary indexes with saved searches

A search to populate a summary index is much like any other saved search (see Chapter 2, Understanding Search, for more details on creating saved searches).

The differences are that this search will run periodically, and the results will be stored in the summary index.

So let's build a simple summary search by following these steps:

  1. Start with a search that produces some statistic:
    source="impl_splunk_gen" | stats count by user
  2. Save this search as summary - count by user.
  3. Edit the search in Settings by navigating to Settings | Searches, reports and alerts| summary – count by user.
  4. Set the appropriate times. This is a somewhat complicated discussion. See the How latency affects summary queries section discussed ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required