We use summary indexing to improve search performance and to avoid unnecessary lookups and field extractions. It is supposed to run every 5 minutes and summarize the previous 5 minute window.
We schedule the saved search values:
index="_internal" sourcetype="scheduler"it becomes apparent that the scheduler is not firing our saves searches reliably every 5 minutes. Sometimes a search will only start 6 or 7 minutes after the previous search. This creates small gaps in the data (of 1 or 2 minutes) that is impossible to backfill with the backfill script provided. Also, it renders the summary index useless.
Is there a way to snap to a more accurate 5 minute window? Or a way to force the scheduler to run more reliably?
What's your setting for
I think in more release release creating a new summary indexing generating scheduled saved search now causes
If you search your summary index for your summary events in question, you should see that
You may also want to look into your
BTW, are you seeing your saved search show up as being "skipped", because then I would expect to see events being dropped. You can search with:
Another thing to consider: Is it possible that you simply don't have any events to summarize for the 5 minute window in question? If this happens, you will see no new events in the summary index (which looks like a "gap"). This may or may not be likely based on your event data, but you should be able to confirm this very quickly with the search:
Of course, if you have some sort of conditional logic, then perhaps this would be a better search: