
ELI5: When (and how) should I be using a summary index?
I've yet to run into an instance of a summary index being referenced, but have been asked to set one up with a 2-year retention period for some specific metrics that would otherwise age-out after 90 days.
Couple questions:
- what – exactly – is a summary index?
- what does a summary index afford me that a normal index does not?
- is a summary index the "right" or "best" solution to collect a couple hundred to few thousand metrics every week or so? (ie, would a lookup table or data model or other option make more sense?)
Submitted March 17, 2020 at 12:39PM
via reddit https://www.reddit.com/r/Splunk/comments/fk8dds/eli5_when_and_how_should_i_be_using_a_summary/?utm_source=ifttt