topic Re: When we need si* for summary indexing? in Getting Data In

When we need si* for summary indexing?

hochit — Mon, 21 Mar 2011 12:56:32 GMT

Is it necessary to use si* command for summary index and we need to make it as scheduled save?

Since I recall the saved search (it's not using si*), it still returns me the result as quick as I recall it from index=summary. Or Splunk actually is doing the trick for me?

Re: When we need si* for summary indexing?

rroberts — Tue, 22 Mar 2011 00:10:34 GMT

If you havent already seen it there is a good article here and link to video ... http://www.splunk.com/base/Documentation/4.2/Knowledge/Usesummaryindexing

"Note: You do not have to use the si- summary index search commands if you are proficient with the "old-school" way of creating summary-index-populating searches. If you create summary indexes using those methods and they work for you there's no need to update them. In fact, they may be more efficient: there are performance impacts related to the use of the si- commands, because they create slightly larger indexes than the "manual" method does."

Re: When we need si* for summary indexing?

gkanapathy — Tue, 22 Mar 2011 00:25:15 GMT

Hmm. It's not always true that si generates large results. For example, for computing medians and percentiles, si will likely be considerably more efficient than whatever you come up with manually. However, there will also be cases where you can't use si commands to summarize and retrieve the data as you need.