Average over time

[bcross64]

I apologize if this has already been posted, but I think I am not really sure how to word the question. I am ingesting a large amount of data from several Windows computers through perfmon. I am reading processor, memory and disk statistics every 5 seconds. Of course, I will never need this fidelity in a report. Is there a way to ingest the statistics, take an average every minute, save the result and discard the original data?

[dwaddle · Accepted solution]

There's summary indexing -- http://docs.splunk.com/Documentation/Splunk/5.0.5/Knowledge/Configuresummaryindexes .. But it really does not address the "discard the original data" part. Summary indexes are "free" (they do not count against your license) and they can be kept on a longer retention than the original indexes they are created from. So you could have your perfmon index with only a 14 day retention (for example) and then have a summary_perfmon index maintained at a longer retention.

[lukejadamec]

Summary indexing sound perfect for your needs.
Understand that summary indexes save statistics as data, not the data they were generated from, so spend time to decide exactly what statistics you want to save. For example: CPU - 5 minute average, 5 minute min, 5 minute max, and a time stamp per server. This will boil down 5 minutes worth of CPU logs for all servers into just 5 pieces of data per server, and save it in a separate index, which makes it very fast to search. The catch is, the data in the summary index cannot be rehydrated - a new search on the raw data is necessary.