Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

question on summary indexing

$
0
0
couple of questions i have: 1st question: i have a large amount of data which i run summary index everyday and collects 24 hour data.( -2d@d and -1d@d) As of now since it does not have much data it performs well. im concerned when the data size would grow eventually it may create problems with performance. so my question is, can i do a weekly summary index run on the daily summary index that is already running. will this help with improving performance when data grows.. 2nd question : Also, how do i go about backfilling older data into the new summary index. since the current summary index is daily, if i run the python script to back fill, will it add old data in daily format or all previous data at once ? thanks in advance for your clarifications..

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>