https://community.splunk.com/t5/Monitoring-Splunk/Lookup-Table-vs-Summary-Index/m-p/28543#M321 <P>I want to create a summary index using a scheduled daily saved search and use in the dashboard view.I can accomplish this using a scheduled daily saved search and create a lookup table as well.In terms of performance, which one is preferable. </P> <P>For eg. <BR /> I have a scheduled search which either build a summary index daily or build a lookup table daily. <BR /> Prior to that, I want to wreck and rebuild the summary index and lookup table daily as well. </P> <P>Using Summary Index<BR /> <OBJECT><PARAM name="search" />index=cc_user_summary source=list_users | fields costCenter, displayName, userUid</OBJECT></P> <P>Using Lookup table<BR /> <OBJECT><PARAM name="search" />| inputlookup userlist.csv | fields costCenter, displayName, userUid</OBJECT></P> Mon, 28 Sep 2020 11:41:14 GMT Sriram 2020-09-28T11:41:14Z https://community.splunk.com/t5/Monitoring-Splunk/Lookup-Table-vs-Summary-Index/m-p/28543#M321 <P>I want to create a summary index using a scheduled daily saved search and use in the dashboard view.I can accomplish this using a scheduled daily saved search and create a lookup table as well.In terms of performance, which one is preferable. </P> <P>For eg. <BR /> I have a scheduled search which either build a summary index daily or build a lookup table daily. <BR /> Prior to that, I want to wreck and rebuild the summary index and lookup table daily as well. </P> <P>Using Summary Index<BR /> <OBJECT><PARAM name="search" />index=cc_user_summary source=list_users | fields costCenter, displayName, userUid</OBJECT></P> <P>Using Lookup table<BR /> <OBJECT><PARAM name="search" />| inputlookup userlist.csv | fields costCenter, displayName, userUid</OBJECT></P> Mon, 28 Sep 2020 11:41:14 GMT https://community.splunk.com/t5/Monitoring-Splunk/Lookup-Table-vs-Summary-Index/m-p/28543#M321 Sriram 2020-09-28T11:41:14Z https://community.splunk.com/t5/Monitoring-Splunk/Lookup-Table-vs-Summary-Index/m-p/28544#M322 <P>Use the lookup table.</P> Tue, 17 Apr 2012 21:35:47 GMT https://community.splunk.com/t5/Monitoring-Splunk/Lookup-Table-vs-Summary-Index/m-p/28544#M322 gkanapathy 2012-04-17T21:35:47Z