how to save calculated fields in index for faster results

[disha]

I am getting events like _time,boxid,MemoryUsage(bytes),filed1,field2,..

I need to run the search something like
...|spath|rename BOXID as ID,MU as mu|eval mu1=round((mu/1024),2)|timechart limit=0 first(mu1) by ID

for last 7 days or more this chart take so much time to load. Can I calculate mu1 (memory usage in mb) and write the value to splunk in advance so that at the time of chart loading, I just read the value and display.

Please suggest.

Thanks,
Disha

[kristian_kolb]

Well, yes, of course.

Have a look at Accelerated Searches or Summary Indexing.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Aboutsummaryindexing

Just saving the results of the calculation round((mu/1024),2) won't improve performance significantly.

/K