Is there a way take existing index and create from it a new index with aggregating search?
meaning taking existing index and using search to create a new aggregated index.
You can create a summary index based on a regular search which could include aggregations.
known reference to previous solutions? to get a a little more details
https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Knowledge/Usesummaryindexing
