If we have summary indexing running on two indexers, will data from both be combined and then aggregated, or computed individually in each of the indexes?

[keerthana_k]

Hi,

We have a Splunk application with two indexers and we have summary indexing running on both of them. I would like to know how exactly Splunk does the summarization.

1. Will the data from both indexers be combined and then aggregated?
2. Or, will the data be computed individually in each of the indexes?
3. If the second case is true, how accurate will the data be, considering that metrics like average will vary based on the sum and count of data present in each of the individual indexer?

[martin_mueller · Accepted solution]

If both indexers are executing summarizing searches on their own data only then the two summaries are independent of each other. Simple counts and sums will remain accurate, averages, dc, etc. should remain accurate when either done properly manually or using sistats.

It'd be easier to maintain and keep accurate if you run the summary search from a search head / job server distributing its search to both indexers and then forwarding its results back to the indexers.