Knowledge Management
Highlighted

index summary vs Cached search results

Path Finder

Hello

can someone explain to me the difference between index summary and Cached search results ?

thanks

Labels (1)
Tags (2)
0 Karma
Highlighted

Re: index summary vs Cached search results

SplunkTrust
SplunkTrust

Summary indexing allows you to follow more of a schema on write system, where you can format the results and aggregate them into kv pairs inside of a summary index. You can also incrementally add to a summary index and include this in your running totals.

You can set the retention on summary indexes for a long period of time (years). Whereas cached search results have a specific TTL which expire in a relatively short period of time. So in short, if you have results which are needed for a limited amount of time, use cached search results. If you want to incrementally add results or query against aggregated results over a long period of time, use a summary index

View solution in original post

0 Karma
Highlighted

Re: index summary vs Cached search results

Path Finder

thanks for the detailed answer

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.