KV Table Vs Summary index Long term performance

[varunCarbyne]

Hi ,
We are using Splunk cluster with 3 SH and 3 Indexers
Through query we are using a growing kvtable to archive few results daily which is impacting our bundle size in replication.
and planned to use Summaryindex.

Currently the numbers of record are same in both kvtable and SI ~ 1,20,000
but while generating the results for older reports I found inputlookup with kv table is taking much less time then SI, This may impact lot to us as we might use multiples of these queries.

below are the 2 quires with time taken to excute :

1) |inputlookup kv_tablex where _time>=[ stats count | addinfo | eval search=info_min_time] AND _time<[ stats count | addinfo | eval search=info_max_time] |table _time field1, field2, field3

this took .38 sec

2) index= summaryindex_of_tablex| where _time>=[ stats count | addinfo | eval search=info_min_time] AND _time<[ stats count | addinfo | eval search=info_max_time]|table _time field1, field2, field3

this took .61 Sec

3) index= summaryindex_of_tablex earliest=[ stats count | addinfo | eval search=info_min_time] latest=[ stats count | addinfo | eval search=info_max_time]|table _time field1, field2, field3

this took .53 Sec

Please help in understanding if I am missing something to optimize the query for SI,
and suggest which one I can use for a long run in a cluster environment

Thanks In Advance

[skoelpin]

You should check out accelerated data models. They are faster than summary indexing and the KV Store.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/Acceleratedatamodels

[varunCarbyne]

Thanks skoelpin,

I will try to evaluate if I can use this for my use-case,
As We are dumping a crunched/ cooked data in SI and not using Pivot for report creation. and we have few custom HTML dashboards due to business requirements, where we are querying thoes SI / KV Tables

Thanks for your help