Book Image

Implementing Splunk (Update)

Book Image

Implementing Splunk (Update)

Overview of this book

Table of Contents (20 chapters)
Implementing Splunk Second Edition
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Index

Reducing summary index size


If the saved search populating a summary index produces too many results, the summary index is less effective at speeding up searches. This usually occurs because one or more of the fields used for grouping has more unique values than expected.

One common example of a field that can have many unique values is the URL in a web access log. The number of URL values might increase in instances where:

  • The URL contains a session ID

  • The URL contains search terms

  • Hackers are throwing URLs at your site trying to break in

  • Your security team runs tools looking for vulnerabilities

On top of this, multiple URLs can represent exactly the same resource, as follows:

  • /home/index.html

  • /home/

  • /home/index.html?a=b

  • /home/?a=b

We will cover a few approaches to flatten these values. These are just examples and ideas and your particular case may require a different approach.

Using eval and rex to define grouping fields

One way to tackle this problem is to make up a new field from the URL using rex...