How can i populate data from primary index to summary index using collect command.
By using collect command can we populate the logs from primary to summary index
Hi @kajalchopade071,
usually summary indexes are used in three cases:
In other words: usually in summary indexes you don't store the full events but only elaborated results of a query.
Ciao.
Giuseppe
Or you can create a report, and use it for summary indexing. Normally, you might put this on a schedule e.g. hourly, but you should make sure that each report does not produce overlapping events with those events already covered by the summary index.