topic summary Index in Splunk Search

summary Index

VijaySrrie — Thu, 01 Apr 2021 04:03:52 GMT

Hi,

how will summary index actually work in relation to 'time based searches'

maybe the summary index could have no time value on each record?

We are replacing a lookup with a summary index.

we have 2000 entries in the lookup --> those entries will be pushed to summary index via a scheduled search

The lookup will be updated daily --> The updated data will go to summary Index

What will happen to old data that is already there in the summary Index?

Re: summary Index

manjunathmeti — Thu, 01 Apr 2021 05:54:04 GMT

hi @VijaySrrie,

Summary index events do have timestamps.

if your saved search results contain a _time field then the timestamp will be set to this field values in the summary index. If _time is not there then timestamp is set to the CURRENT time(when data is parsed) in the summary index.

Retention for the summary index is 5 years and the max data size is 500GB.

If this reply helps you, a like would be appreciated.