A summary index is a place to store events calculated by Splunk. Usually, these events are aggregates of raw events broken up over time, for instance, the number of errors that occurred per hour. By calculating this information on an hourly basis, it is cheap and fast to run a query over a longer period of time, for instance, days, weeks, or months.

A summary index is usually populated from a saved search with summary indexing enabled as an action. This is not the only way, but is certainly the most common.

On disk, a summary index is identical to any other Splunk index. The difference is solely the source of data. We create the index through configuration or through the GUI like any other index, and we manage the index size in the same way.

Think of an index like a table or possibly a tablespace, in a typical SQL database. Indexes are capped by size and/or time much like a tablespace, but all the data is stored together much like a table. We will discuss index...