We currently use 6.6.2 and we rely on summary indexes to avoid recalculation of old data.
We want to evaluate Splunk 7's metrics but we find that summary indexes are not supported. Is there any alternative for us to use metrics and store previous calculations in summary indexes? We tried KV Store for this purpose earlier and there was lot of performance impact.
This is because in 7, we introduced a new type of index, which is for metrics. This is a very condensed index, and there is very little data stored in these. More akin to a summary index in regards to the size of each event, there will only, in general be the following fields (which act as indexed fields)
You also see that you have to use a different set of commands to work with Metrics ( mstats and mcatalog) See here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Search
In general, performance will be similar, and actually much faster then a summary index. And that is because the metrics treats these events as indexed fields. Akin to the tstats command.
So in answer to your question, Summary indexes are not support as MEtric index types. However, you can aggregate events from the Metrics indexes with the mstats command, and then collect these to a Summary Index, in the same way you do now..
Hope that helps..
Much appreciated @esix - the Vignette people among us would appreciate any additional caching features of the product.
no worries - I call these features caching features as this is my background and that's the way I perceive them.