Knowledge Management

index summary vs Cached search results

sarit_s
Communicator

Hello

can someone explain to me the difference between index summary and Cached search results ?

thanks

Labels (1)
Tags (2)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Summary indexing allows you to follow more of a schema on write system, where you can format the results and aggregate them into kv pairs inside of a summary index. You can also incrementally add to a summary index and include this in your running totals.

You can set the retention on summary indexes for a long period of time (years). Whereas cached search results have a specific TTL which expire in a relatively short period of time. So in short, if you have results which are needed for a limited amount of time, use cached search results. If you want to incrementally add results or query against aggregated results over a long period of time, use a summary index

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Summary indexing allows you to follow more of a schema on write system, where you can format the results and aggregate them into kv pairs inside of a summary index. You can also incrementally add to a summary index and include this in your running totals.

You can set the retention on summary indexes for a long period of time (years). Whereas cached search results have a specific TTL which expire in a relatively short period of time. So in short, if you have results which are needed for a limited amount of time, use cached search results. If you want to incrementally add results or query against aggregated results over a long period of time, use a summary index

0 Karma

sarit_s
Communicator

thanks for the detailed answer

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...