- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- Re: summary indexes + metrics in Splunk 7.0.0
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
We currently use 6.6.2 and we rely on summary indexes to avoid recalculation of old data.
We want to evaluate Splunk 7's metrics but we find that summary indexes are not supported. Is there any alternative for us to use metrics and store previous calculations in summary indexes? We tried KV Store for this purpose earlier and there was lot of performance impact.
regards
Pramodh
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is because in 7, we introduced a new type of index, which is for metrics. This is a very condensed index, and there is very little data stored in these. More akin to a summary index in regards to the size of each event, there will only, in general be the following fields (which act as indexed fields)
Timestamp
Source
Sourcetype
Host
Metric Name
Value
and Dimensions
Read up here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Overview
You also see that you have to use a different set of commands to work with Metrics ( mstats and mcatalog) See here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Search
In general, performance will be similar, and actually much faster then a summary index. And that is because the metrics treats these events as indexed fields. Akin to the tstats command.
So in answer to your question, Summary indexes are not support as MEtric index types. However, you can aggregate events from the Metrics indexes with the mstats command, and then collect these to a Summary Index, in the same way you do now..
Hope that helps..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is because in 7, we introduced a new type of index, which is for metrics. This is a very condensed index, and there is very little data stored in these. More akin to a summary index in regards to the size of each event, there will only, in general be the following fields (which act as indexed fields)
Timestamp
Source
Sourcetype
Host
Metric Name
Value
and Dimensions
Read up here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Overview
You also see that you have to use a different set of commands to work with Metrics ( mstats and mcatalog) See here : https://docs.splunk.com/Documentation/Splunk/7.0.0/Metrics/Search
In general, performance will be similar, and actually much faster then a summary index. And that is because the metrics treats these events as indexed fields. Akin to the tstats command.
So in answer to your question, Summary indexes are not support as MEtric index types. However, you can aggregate events from the Metrics indexes with the mstats command, and then collect these to a Summary Index, in the same way you do now..
Hope that helps..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can we delete this metrics index? How can we disable this index or sourcetype? It is consuming 20 GB of license for us and we do not find any additional functionality with this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Much appreciated @esix - the Vignette people among us would appreciate any additional caching features of the product.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Caching in regards to what?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
no worries - I call these features caching features as this is my background and that's the way I perceive them.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
