Knowledge Management

index summary vs Cached search results

sarit_s
Communicator

Hello

can someone explain to me the difference between index summary and Cached search results ?

thanks

Labels (1)
Tags (2)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Summary indexing allows you to follow more of a schema on write system, where you can format the results and aggregate them into kv pairs inside of a summary index. You can also incrementally add to a summary index and include this in your running totals.

You can set the retention on summary indexes for a long period of time (years). Whereas cached search results have a specific TTL which expire in a relatively short period of time. So in short, if you have results which are needed for a limited amount of time, use cached search results. If you want to incrementally add results or query against aggregated results over a long period of time, use a summary index

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Summary indexing allows you to follow more of a schema on write system, where you can format the results and aggregate them into kv pairs inside of a summary index. You can also incrementally add to a summary index and include this in your running totals.

You can set the retention on summary indexes for a long period of time (years). Whereas cached search results have a specific TTL which expire in a relatively short period of time. So in short, if you have results which are needed for a limited amount of time, use cached search results. If you want to incrementally add results or query against aggregated results over a long period of time, use a summary index

0 Karma

sarit_s
Communicator

thanks for the detailed answer

Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...