Knowledge Management

Can you help me with my query involving a saved search and summary indexing?

Log_wrangler
Builder

Hi,

I am trying to understand how and where Splunk stores data from saved searches that populates a new summary index.

Scenario:

Another admin set up a number of queries/searches against 3 different indexes to run on different time schedules (like once a week or every 4 hours). These searches alert on specific events and send alert emails when there is a hit. Additionally, the search results are sent to a "summary" (not sure if that is the correct term) index that combines all the different query results under one index, which is then used to create a dashboard.

So I have 10 separate searches that queries 3 different indexes.

When an event is found, the results are being sent to a "new_index', which is not defined on the indexers > indexes.conf, but only on the search head...

On the search head, I can find the new_index in /opt/splunk/var/lib/splunk/new_index... , but I don't see the 'new_index' on the indexers... Is that possible? where is that data being stored?

I have looked at the documentation but in this case I am confused. I thought summary indexes were also saved on the indexers.

Please advise.

Thank you

0 Karma
1 Solution

Vijeta
Influencer

It is stored on the index on your search head. You can create indexes both on the search head and the indexer. The summary indexes are used to populate the aggregate data based on your query so the dashboard needs to search through a defined set of data with minimal query.

Summary index can also be defined on indexer instead of the search head (usually done in clustered set up). Any index if you define as summary index will collect the data in sourcetype 'stash' , and it is not counted against the license.

View solution in original post

0 Karma

Vijeta
Influencer

It is stored on the index on your search head. You can create indexes both on the search head and the indexer. The summary indexes are used to populate the aggregate data based on your query so the dashboard needs to search through a defined set of data with minimal query.

Summary index can also be defined on indexer instead of the search head (usually done in clustered set up). Any index if you define as summary index will collect the data in sourcetype 'stash' , and it is not counted against the license.

0 Karma

Log_wrangler
Builder

Thank you for the explanation.
So the only place I see data is /opt/splunk/var/lib/splunk/new_index on the search head is that the correct location in this case?

Vijeta
Influencer

This is the correct location for an index.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...