Is there a licensing difference between using the collect command explicitly in the saved search rather than enabling summary indexing in the UI or savedsearches.conf?
This would appear to suggest that there are not:
http://answers.splunk.com/questions/8015/how-does-splunk-determine-data-is-being-summarized-and-thus...
This would appear to suggest that there are not:
http://answers.splunk.com/questions/8015/how-does-splunk-determine-data-is-being-summarized-and-thus...
woo hoo! Thanks for using your answers search skillz!