https://community.splunk.com/t5/Knowledge-Management/Summary-Index-Limitations/m-p/381964#M3266 <P>summary index is just like any other index<BR /> its limited by the configurations you set in indexes.conf (also via ui)<BR /> retention, size and other parameters are set by you</P> Tue, 09 Jul 2019 15:25:21 GMT adonio 2019-07-09T15:25:21Z https://community.splunk.com/t5/Knowledge-Management/Summary-Index-Limitations/m-p/381963#M3265 <P>Hello,</P> <P>I am using a summary index to track a handful of our key metrics per day over time. I am using the summary index for the purposes of improving search response times of panels on some of our dashboards. </P> <P>The data in the summary index contains daily averages and counts per customer for 8 of our KPI’s. The events are written across 8 different sources in our summary index. About 600k total events are being written to the summary index each day. Are there any performance/capacity repercussions to this? From what I understand the summary index has no data retention limitations. Is 600k events per day in the summary index acceptable? We are using Splunk Cloud. </P> <P>Thanks,<BR /> Chris</P> Tue, 09 Jul 2019 13:35:18 GMT https://community.splunk.com/t5/Knowledge-Management/Summary-Index-Limitations/m-p/381963#M3265 cwinkler109 2019-07-09T13:35:18Z https://community.splunk.com/t5/Knowledge-Management/Summary-Index-Limitations/m-p/381964#M3266 <P>summary index is just like any other index<BR /> its limited by the configurations you set in indexes.conf (also via ui)<BR /> retention, size and other parameters are set by you</P> Tue, 09 Jul 2019 15:25:21 GMT https://community.splunk.com/t5/Knowledge-Management/Summary-Index-Limitations/m-p/381964#M3266 adonio 2019-07-09T15:25:21Z