Summary
The key takeaways from this chapter are as follows:
There are currently three methods of data summarization in Splunk: summary indexing, report acceleration, and data model acceleration
Summary indexing can greatly improve the time taken to access key metrics computed over long periods of time
Summary indexing provides a method to retain data over long periods of time with a much smaller footprint on disk space
Report acceleration provides an intelligent method for automatically summarizing report data to enhance the speed of the report
Report acceleration summary data is shared amongst similar reports automatically
Report acceleration is self-repairing; it will automatically detect gaps in data and recompute the expected data summaries
The speed at which reports are produced is a cornerstone to a successful Operational Intelligence program
