|
I want to create a summary index using a scheduled daily saved search and use in the dashboard view.I can accomplish this using a scheduled daily saved search and create a lookup table as well.In terms of performance, which one is preferable. For eg. I have a scheduled search which either build a summary index daily or build a lookup table daily. Prior to that, I want to wreck and rebuild the summary index and lookup table daily as well. Using Summary Index <param name="search">index=cc_user_summary source=list_users | fields costCenter, displayName, userUid</param> Using Lookup table <param name="search">| inputlookup userlist.csv | fields costCenter, displayName, userUid</param> |
One Answer:
