Cisco Firewall Datacube Summary Index

[BP9906]

Hello,
I could not find much documentation about this so thats why I'm posting here.
I wanted to find out more information about the Cisco Firewall datacube scheduled searches for summary indexing.

1) Whats its purpose?
2) How could I prove that it is causing the "stash" sourcetype to spike during the 6hr scheduled summary indexing? metrics.log shows a spike but not where its coming from. The dates/times correspond with the scheduler.log for this saved search.
3) What do I break if I shut it off?

Thank you!

[dart]

It's a summary search used in the Splunk App for Cisco Security.

All summary searches will use the stash sourcetype. You could prove that it's this search by running a search for index=* sourcetype=stash | stats count by search_name which will tell you how many results are generated from each summary search. If you really need approx data size then this will give you it, but it will be slower index=* sourcetype=stash | stats count sum(eval(len(_raw))) as utf8_chars by search_name

You may break some views in the Splunk App for Cisco Security.