Knowledge Management
Highlighted

summary indexes + metrics in Splunk 7.0.0

Path Finder

Hi,

We currently use 6.6.2 and we rely on summary indexes to avoid recalculation of old data.

We want to evaluate Splunk 7's metrics but we find that summary indexes are not supported. Is there any alternative for us to use metrics and store previous calculations in summary indexes? We tried KV Store for this purpose earlier and there was lot of performance impact.

regards
Pramodh

0 Karma
Highlighted

Re: summary indexes + metrics in Splunk 7.0.0

Splunk Employee
Splunk Employee

This is because in 7, we introduced a new type of index, which is for metrics. This is a very condensed index, and there is very little data stored in these. More akin to a summary index in regards to the size of each event, there will only, in general be the following fields (which act as indexed fields)

Timestamp
Source
Sourcetype
Host
Metric Name
Value
and Dimensions

Read up here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Overview

You also see that you have to use a different set of commands to work with Metrics ( mstats and mcatalog) See here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Search

In general, performance will be similar, and actually much faster then a summary index. And that is because the metrics treats these events as indexed fields. Akin to the tstats command.

So in answer to your question, Summary indexes are not support as MEtric index types. However, you can aggregate events from the Metrics indexes with the mstats command, and then collect these to a Summary Index, in the same way you do now..

Hope that helps..

View solution in original post

Highlighted

Re: summary indexes + metrics in Splunk 7.0.0

Ultra Champion

Much appreciated @esix - the Vignette people among us would appreciate any additional caching features of the product.

0 Karma
Highlighted

Re: summary indexes + metrics in Splunk 7.0.0

Splunk Employee
Splunk Employee

Caching in regards to what?

0 Karma
Highlighted

Re: summary indexes + metrics in Splunk 7.0.0

Ultra Champion

no worries - I call these features caching features as this is my background and that's the way I perceive them.

0 Karma