A search to populate a summary index is much like any other saved search (see Chapter 3, Understand Search, for more details on creating saved searches).
The differences are that this search will run periodically, and the results will be stored in the summary index.
So, let's build a simple summary search by following these steps:
- Start with a search that produces some statistic:
source="impl_splunk_gen" | stats count by user
- Save this search as
summary - count by user
. - Edit the search in
Settings
by navigating toSettings
|Searches, reports and alerts
|summary - count by user
. - Set the appropriate times. This is a somewhat complicated discussion. See the How latency affects summary queries section discussed later:
Let's look at the following fields:
Search
:source="impl_splunk_gen" | stats count by user
. This is our query. Later we will usesistats
, a special summary index version of stats.
You can stipulate absolute or relative time ranges using time...