How to schedule daily summary indexing with a search that uses the geostats command? Is there another approach?

[cheinlein]

My search is simple:

sourcetype=log_data | iplocation c_ip | geostats latfield=lat longfield=lon count

but I have a lot of data, about 100,000,000 logs a day, and the customer wants a monthly summary. A monthly search would be too slow. I'd like to be able to write a daily summary and schedule it, but there is no summary indexing for the geostats command. (sigeostats ). Ideas on another way to approach this?

[knielsen]

You don't need the si commands at all to populate a summary index. Your search works fine as a daily search for that. Well, it depends on what you do with the data later on. I have about 200 summary indexes in place, I never even tried the si commands, they are all built by searches using stats.