We are reporting daily new user added in system. WE have recently moved to summary indexing and we are getting data. Now as we are moving forward, is there a way we can reuse existing summary index data and current reporting.
For example
We are adding 25 user daily, so for a month we have added 750 users. Now when I will move to next month is there a way I can reuse this data, such that when any time I want to know how many users logged in till date. I can add all months data (I have restriction not to keep more then 3 months data in hot storage) in my current months tally. Also I am reporting numbers for this month too.
Here is some query I am using.
index=summary search="test" |bin span=7d _time | dedup puserid | stats dc(puserid)
My search "test" is running hourly and giving me new users in terms of puserid.
If your sampling rate is hourly, your summary index in a year will have a total number of samples equal to 24 samples_per_day * 365 = 8760 events. Your summary index should be able to handle this. So, I do not see any problem.