summary indexes + metrics in Splunk 7.0.0

[ykpramodhcbt]

Hi,

We currently use 6.6.2 and we rely on summary indexes to avoid recalculation of old data.

We want to evaluate Splunk 7's metrics but we find that summary indexes are not supported. Is there any alternative for us to use metrics and store previous calculations in summary indexes? We tried KV Store for this purpose earlier and there was lot of performance impact.

regards
Pramodh

[esix_splunk · Accepted solution]

This is because in 7, we introduced a new type of index, which is for metrics. This is a very condensed index, and there is very little data stored in these. More akin to a summary index in regards to the size of each event, there will only, in general be the following fields (which act as indexed fields)

Timestamp
Source
Sourcetype
Host
Metric Name
Value
and Dimensions

Read up here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Overview

You also see that you have to use a different set of commands to work with Metrics ( mstats and mcatalog) See here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Search

In general, performance will be similar, and actually much faster then a summary index. And that is because the metrics treats these events as indexed fields. Akin to the tstats command.

So in answer to your question, Summary indexes are not support as MEtric index types. However, you can aggregate events from the Metrics indexes with the mstats command, and then collect these to a Summary Index, in the same way you do now..

Hope that helps..

[Splunksc]

Can we delete this metrics index? How can we disable this index or sourcetype? It is consuming 20 GB of license for us and we do not find any additional functionality with this?

[ddrillic]

Much appreciated @esix - the Vignette people among us would appreciate any additional caching features of the product.

[esix_splunk]

Caching in regards to what?

[ddrillic]

no worries - I call these features caching features as this is my background and that's the way I perceive them.