Documentation: 3.3
|  Print Version Contents
This page last updated: 08/04/08 04:08pm

Configure summary indexing

The information in this section explains how to further configure summary indexing once you enable it in Splunk Web.

Note: You must set up the summary indexing via Splunk Web before you configure additional settings in savedsearches.conf. Learn how to configure summary indexing for a scheduled saved search via Splunk Web.

When you enable summary indexing for a saved search in Splunk Web, Splunk automatically generates a stanza in savedsearches.conf. Customize summary indexing by editing the generated stanza. Splunk names the stanza based on the name of the saved search for which you enabled summary indexing, like this: [summary_savedsearchname].

Summary indexing keys:

action.summary_index = Set to 1 to enable summary indexing. Set to 0 to disable summary indexing.
action.summary_index.fieldname = value Specify a field/value pair to add to every search result indexed in the summary index. Specify any numeric or string value for value. Add additional action.summary_index.fieldname = value | "value" | "long string" entries to append as many field/value pairs to events going into the summary index as you like.

Example:
This example shows a configuration for a summary index of Web statistics. The keys listed below enable summary indexing for the saved search "MonthlyWebstatsReport", and append the field Webstatsreport with a value of 2008 to every event going into the summary index. 

# name of the summary index= MonthlyWebstatsReport
[summary_MonthlyWebstatsReport]
# enable summary indexing
action.summary_index = 1   
# add these keys to each  event
action.summary_index.Webstatsreport=2008

Other configuration files affected by summary indexing

In addition to the settings you configure in savedsearches.conf, summary indexing requires that settings exist in indexes.conf, and alert_actions.conf. Splunk ships with the necessary default settings:

  • indexes.conf: A stanza with the index configuration information for the summary index.
  • alert_actions.conf: Settings that control the alert actions (including summary indexing) associated with saved searches.

Caution: Do not edit settings in alert_actions.conf without explicit instructions from Splunk staff.

Summary indexing and license volume

Indexing events in a summary index counts against your license volume. We recommend that you not index more events in your summary indexes than you really need. Consult Splunk support for specific information on license volume impact.

Manually configure summary indexing

These instructions show you how to configure summary indexing without using the alert options dialog in Splunk Web.

1. Configure a summary index just like you would any other index via indexes.conf. Learn how to configure an index.

  • Important: You must restart Splunk for changes in indexes.conf to take effect.

2. Run a search that you want to summarize results from in the search bar of Splunk Web.

  • Be sure to limit the time range of your search. The number of results that your search generates needs to fit within the maximum search result limits you have set for searching.
  • Make sure to choose a time interval that works for your data (for example: 10 minutes, 2 hours, 1 day).

3. Add the addinfo command to your search (append | addinfo at the end of your search).

  • This adds information about the search to events that the collect command requires in order to place them into a summary index.
  • You can always add | addinfo to any search to preview what the results of a search will look like in a summary index.

4. Add the collect command to your search (append | collect index=<summaryindexname>).

  • Use collect to index your search results into the summary index you created in step 1.
  • Your final search should look like: <search string>... | addinfo | collect index=<summaryindexname> (plus any collect options you specify).

Save and schedule a manually configured summary indexing search

5. Save the search.

6. Schedule the search.

7. Enable summary indexing for the saved search via savedsearches.conf.

  • Configure summary indexing for a saved search by adding the following keys:
    • action.summary_index = <1 | 0>: Set to 1 to enable summary indexing for a saved search.
    • action.summary_index._name = <string>: Add the name of the summary index you created in step 1.
  • Add additional data to your events going into a summary index using this key:
    • action.summary_index.<$KEY> = <string>: Add additional field/value pairs to events going into your summary index. Add as many as you like.
Previous: Macro searches    |    Next: Live tail

Comments

No comments have been submitted.

Log in to comment.