Splunk Operational Intelligence Cookbook - Third Edition

Generating the summary more frequently

In this recipe, the summary-generating search was set to run hourly and look back over the past hour. This results in a single event being generated per hour and written to the summary. If more granularity is required, the search can be set to run every 15 minutes; look back over the past 15 minutes, and four events per hour will be generated. As the search is now only looking back over the past 15 minutes, instead of the past hour, it will likely execute faster as there is less data to search over. For some data sources, generating the summary index data more frequently over smaller chunks of time can be more efficient.