- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Lookup Table vs Summary Index
Sriram
Communicator
04-17-2012
11:37 AM
I want to create a summary index using a scheduled daily saved search and use in the dashboard view.I can accomplish this using a scheduled daily saved search and create a lookup table as well.In terms of performance, which one is preferable.
For eg.
I have a scheduled search which either build a summary index daily or build a lookup table daily.
Prior to that, I want to wreck and rebuild the summary index and lookup table daily as well.
Using Summary Index
Using Lookup table
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gkanapathy

Splunk Employee
04-17-2012
02:35 PM
Use the lookup table.
