Are there summary index naming convention standards?

[cesaccenturefed]

So I need to set up a summary index for our reporting team to do our monthly reports. Are there any naming conventions that I need to abide by?

If I name the index "report" or "report_summary", does it matter? Does the name matter when counting against your license? Are events in summary indexes exempt from your license count? How are summary events not counted towards your license?

[anwarmian]

You can use the guideline documented in:
https://docs.splunk.com/Documentation/CoE/current/Handbook/Naming

For summary index use:
companyname_purpose_sensitivity_summary naming convention

Example: acme_report_prod_summary
or
yourcompanyname_report_dev_summary

[skoelpin · Accepted solution]

I typically add "DO NOT CLICK" as the prefix of the report name so I accidentally don't click it and run another populating search.. Also make sure the permissions are set to private so other users cant run the populating search.

The only thing that will count against your licenses is if you index more data, so "reindexing" your data which was already indexed will not count against your licenses, so your safe to run as many summary indexes as you wish.

[woodcock]

HA! You got that from me! 😆 I am glad to see that it has worked all those years!

[skoelpin]

Yes I did!

Naming convention is everything, especially when scaling