Knowledge Management

Using summary index by default in app?

erydberg
Splunk Employee
Splunk Employee

I'm writing an app that I know will index loads of data and then do some calculations on changes from day to day. To make my dashboards and reports faster I want to include saved searches that put data into a summary index. What is the best practice on this? The docs imply that all summary indexes needs to be configured via the ui, which will put the saved searches in local/, does that mean that you're not supposed to have summary indexes in apps by default?

http://www.splunk.com/base/Documentation/4.1.2/Knowledge/Configuresummaryindexes

Thanks

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

The docs may give that impression but no it's quite common for apps to have preconfigured summary indexing searches. The windows app is a common example - it runs a search called win_eventlog_count_sum_index and you'll see the relevant stanza has summary indexing going on, and it's just sitting in the app's default directory.

I think some app developers have success using the manager UI to create and edit items destined for an app, and then they use the manager UI to 'move' the items up into the app space. Possibly there's some final merging of the app/local into app/default, im not sure.

And other crustier app developers just bypass the UI and manually create and edit the app's default config on disk, refreshing changes by either hitting the refresh endpoint or restarting the server.

View solution in original post

sideview
SplunkTrust
SplunkTrust

The docs may give that impression but no it's quite common for apps to have preconfigured summary indexing searches. The windows app is a common example - it runs a search called win_eventlog_count_sum_index and you'll see the relevant stanza has summary indexing going on, and it's just sitting in the app's default directory.

I think some app developers have success using the manager UI to create and edit items destined for an app, and then they use the manager UI to 'move' the items up into the app space. Possibly there's some final merging of the app/local into app/default, im not sure.

And other crustier app developers just bypass the UI and manually create and edit the app's default config on disk, refreshing changes by either hitting the refresh endpoint or restarting the server.

piebob
Splunk Employee
Splunk Employee

yeah, the doc was written with end users in mind more than developers. we'll add some information explaining the available options for developers.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...