Difference Between Event and Metric Indexes in Terms of Storage and Indexing

[grunt]

I'm trying to understand the differences between event indexes and metric indexes in terms of how they handle storage and indexing. I have a general understanding of how event indexes work based on this document, but the documentation on metrics seems limited.

Specifically, I'm curious about:

1. How storage and indexing differ for event indexes vs. metric indexes under the hood.
2. Why high cardinality is a bigger concern for metric indexes compared to event indexes.

I understand from this glossary entry that metric time series (MTS) are central to how metrics work, but I'd appreciate a more in-depth explanation on the inner workings and trade-offs involved.

Additionally, if I have a dimension with a unique ID, would it be better to use an event index instead of a metric index?

If anyone could shed light on this or point me toward relevant resources, that would be great!

[isoutamo]

Here is interesting conf presentation which may help you to understand difference between metrics and event indexes. https://conf.splunk.com/files/2022/recordings/OBS1157B_1080.mp4
I think that it's still quite accurate, but if I recall right there have happened some changes how ingestion amount is calculated with metrics? Basically this should be better for end users.
Here is also basic information about Metrics https://docs.splunk.com/Documentation/Splunk/latest/Metrics/GetStarted
r. Ismo