My search is simple:
sourcetype=log_data | iplocation c_ip | geostats latfield=lat longfield=lon count
but I have a lot of data, about 100,000,000 logs a day, and the customer wants a monthly summary. A monthly search would be too slow. I'd like to be able to write a daily summary and schedule it, but there is no summary indexing for the geostats command. (sigeostats ). Ideas on another way to approach this?
You don't need the si commands at all to populate a summary index. Your search works fine as a daily search for that. Well, it depends on what you do with the data later on. I have about 200 summary indexes in place, I never even tried the si commands, they are all built by searches using stats.