ELI5: When (and how) should I be using a summary index? via /r/Splunk


ELI5: When (and how) should I be using a summary index?

I've yet to run into an instance of a summary index being referenced, but have been asked to set one up with a 2-year retention period for some specific metrics that would otherwise age-out after 90 days.

Couple questions:

  • what – exactly – is a summary index?
  • what does a summary index afford me that a normal index does not?
  • is a summary index the "right" or "best" solution to collect a couple hundred to few thousand metrics every week or so? (ie, would a lookup table or data model or other option make more sense?)

Submitted March 17, 2020 at 12:39PM
via reddit https://www.reddit.com/r/Splunk/comments/fk8dds/eli5_when_and_how_should_i_be_using_a_summary/?utm_source=ifttt