I am presently using an index say "1234-index" where i have different source types to cater my needs. However, I have one particular source type for which i need to collect the summary data.
so is it necessary to create an entirely new index for summary or can i just use the "1234-index" index and mark it to enable capturing summary data as well in a separate source type?
Summary index is nothing but just another index. It's more about for what purpose you are using the summary index.
Usually it's used to efficiently report on large volumes of data , i.e. if you want to run a report for last 30 days from an index with millions of events, you may schedule a search to run every day to extract precise information you want on the final report and populate the summary index. So the final report can run on this summary index more efficiently.
Usually, summary index is a separate index so that you can reduce the data volume you search and avoid duplicate information in the same index. Moreover, summary indexing volume is not counted against your license, even if you have several summary indexes.
The suggestion to my posted issue here, was to use collect command. but in order to use collect command, i further found that it needs summary index to be configured. Hence, i configured one. but even post that i am not able to get things working in my favour.
the following is the savedsearches.conf changes made to enable summary indexing, and below is the query i am using to write an event to an index.