HI Bkoutsky,
Here is my recommendation: Yes. create multiple summary indexes but don't over do it.
I recommend creating a summary index for each search granularity. So, for example, I would have 3 summary indexes. The FIRST would be for summary searches that are less than an hour (5m, 10m, 15m, etc). I would use a SECOND one for hourly summaries up to a day and a THIRD one for summaries that are a day or longer.
I would label them like so: summary_5m, summary_1h and summary_1d
Having three summaries will allow you to set different retention policies and different rights/privileges for each, if necessary.
You can also do other cool things such as build the hourly summary index from the 5m summary and the daily summary from the hourly one!
Hope this helps!
d.
- please vote if you find this answer useful!
... View more