Is there a way to keep more than 10.000 events on a summary index for a schedule search ?
I would like to store events per second for a full day, based on a schedule search executed once a day.
already covered here: http://answers.splunk.com/questions/1942/why-are-only-10-000-events-making-it-into-the-summary-index
View solution in original post