Implementing Splunk 7, Third Edition - Third Edition

Understanding summary indexes

A summary index is a place to store events calculated by Splunk. Usually, these events are aggregates of raw events broken up over time, for instance, the number of errors that occurred per hour. By calculating this information on an hourly basis, it is cheap and fast to run a query over a longer period of time, for instance, days, weeks, or months.

A summary index is usually populated from a saved search with summary indexing enabled as an action. This is not the only way, but it is certainly the most common one.

On disk, a summary index is identical to any other Splunk index. The difference is solely the source of data. We create the index through configuration or through the GUI like any other index, and we ...