I want to create a summary index using a scheduled daily saved search and use in the dashboard view.I can accomplish this using a scheduled daily saved search and create a lookup table as well.In terms of performance, which one is preferable.
For eg. I have a scheduled search which either build a summary index daily or build a lookup table daily. Prior to that, I want to wreck and rebuild the summary index and lookup table daily as well.
Using Summary Index <param name="search">index=cc_user_summary source=list_users | fields costCenter, displayName, userUid</param>
Using Lookup table <param name="search">| inputlookup userlist.csv | fields costCenter, displayName, userUid</param>
Use the lookup table.
answered 17 Apr '12, 14:35