As the number of events retrieved by a query increases, performance decreases linearly. Summary indexing allows you to calculate the statistics in advance and then run reports against these roll ups, dramatically increasing performance.
In this chapter, we will cover the following topics:
Understanding summary indexes
When to use a summary index
When not to use a summary index
Populating summary indexes with saved searches
Using summary index events in a query
Using
sistats,sitop, andsitimechartHow latency affects summary queries
How and when to backfill summary data
Reducing summary index size
Calculating
topfor a large time frameUsing CSV files to store transient data
Speeding up queries and backfilling