Our "best" internal client would like to start with summary indexes. Is there a good document out there for them?
Hey
Have a look at this answers/docs
https://answers.splunk.com/answers/439513/best-practices-for-summary-indexing.html
https://wiki.splunk.com/Community:Summary_Indexing
Also look at about configuring summary indexes
http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Configuresummaryindexes
Let me know if this helps !
Hey
Have a look at this answers/docs
https://answers.splunk.com/answers/439513/best-practices-for-summary-indexing.html
https://wiki.splunk.com/Community:Summary_Indexing
Also look at about configuring summary indexes
http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Configuresummaryindexes
Let me know if this helps !
Gorgeous !