I recently created a Summary Index to use with some planned dashboards. To generate the Summary Index I run a report each night with Time Range set to Yesterday, "bucket _time span=day" to summarize each day into one entry, then add it to the Summary Index.
Right now I wish I had more historical data in that Summary Index so I'm wondering if its OK to establish the Summary Index freshly, perhaps with a timeframe of Last 30 Days or Last 45 Days, then the next day update the report schedule to look just for Yesterday and continue on like that.
That's fine - funnily enough, exactly what I have been doing today! Your search for back-filling the summary index should probably bin your events by day so that they appear as if they have been collected over the past 45 days
That's fine - funnily enough, exactly what I have been doing today! Your search for back-filling the summary index should probably bin your events by day so that they appear as if they have been collected over the past 45 days