Splunk Interview Questions for Developer

7. What is the sequence of search time operation ?

8. What is summary index in splunk?

Summary index is that you can retain the analytics and reports even after your data has aged out.

For example:

• Assume that your data retention policy is only for 6 months but, your data has aged out and is older than a few months. If you still want to do your own calculation or dig out some statistical value, then during that time, summary index is useful.
• you can store the summary and statistics of the percentage growth of sale that took place in each of the last 6 months and you can pull the average revenue from that. That average value is stored inside summary index.