We are reporting daily new user added in system. WE have recently moved to summary indexing and we are getting data. Now as we are moving forward, is there a way we can reuse existing summary index data and current reporting.
For example
We are adding 25 user daily, so for a month we have added 750 users. Now when I will move to next month is there a way I can reuse this data, such that when any time I want to know how many users logged in till date. I can add all months data (I have restriction not to keep more then 3 months data in hot storage) in my current months tally. Also I am reporting numbers for this month too.
Here is some query I am using.
index=summary search="test" |bin span=7d _time | dedup puserid | stats dc(puserid)
My search "test" is running hourly and giving me new users in terms of puserid.
