Backfill summary index without original data?

[alexiri]

We used to have a system that aggregated accounting information from some log files and produced daily summaries. We have about 5 years' worth of this summary data.

Now we'd like to use Splunk to index the accounting logs and to produce daily summaries in a summary index. However, we'd also like to be able to import all our old summary data into the summary index. The fill_summary_index.py script doesn't help here because the original data is gone. Is there a way to do this?

[mw]

There's nothing special about a "summary index" except that the data it holds is summarized. If you have data that is already summarized you can just stuff it in any index (just create a new one) and use it just like you would any other data (i.e. index=accounting_data | timechart sum(income) by department).

[alexiri]

My summary index is built with sistats, so I'm not quite sure of what the internal format is like. Is there any description of it?