Populating summary indexes with saved searches
A search to populate a summary index is much like any other saved search (see Chapter 2, Understand Search, for more detail on creating saved searches). The differences are that this search will run periodically and the results will be stored in the summary index. Let's build our first summary search by following these steps:
- Start with a search that produces some statistic:
source="impl_splunk_gen" | stats count by user
- Save this search as
summary - count by user. - Edit the search in Manager by navigating to Manager | Searches and reports | summary – count by user. The Save search... wizard provides a link to the manager on the last dialog in the wizard.
- Set the appropriate times. This is a somewhat complicated ...
Get Implementing Splunk: Big Data Reporting and Development for Operational Intelligence now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
