I'm trying to understand the differences between event indexes and metric indexes in terms of how they handle storage and indexing. I have a general understanding of how event indexes work based on this document, but the documentation on metrics seems limited. Specifically, I'm curious about: How storage and indexing differ for event indexes vs. metric indexes under the hood. Why high cardinality is a bigger concern for metric indexes compared to event indexes. I understand from this glossary entry that metric time series (MTS) are central to how metrics work, but I'd appreciate a more in-depth explanation on the inner workings and trade-offs involved. Additionally, if I have a dimension with a unique ID, would it be better to use an event index instead of a metric index? If anyone could shed light on this or point me toward relevant resources, that would be great! ... View more

We are using a metrics index to store metric events. These metric events are linked to a different parent dataset through a unique ID dimension. This ID dimension can have tens of thousands of unique values, and the parent dataset primarily consists of string values. Given the cardinality issues associated with metric indices (where it's best to avoid dimensions with a large range of unique values), what would be the best practice in this scenario? https://docs.splunk.com/Documentation/Splunk/latest/Metrics/BestPractices#Cardinality_issues  Would it be a good idea to use a key-value store (kvstore) for the parent data and perform lookups from the metric data? How would this approach impact performance? ... View more