Question

I am configuring a simple table in SQL Server. It is named “LOG” and as you might expect, it is used to record logs, for later monitoring/searching/grouping the use of various applications in various manners.

The table is declared somewhat like that (simple syntax) :

LOG {
   user   varchar(8),
   timestamp  datetime,
   appname   varchar(16)
}
primary key(user,timestamp,appname)

Should I index each column in a separate index? All three in the same index?
Clustered / non-clustered?

I’d be happy to see what logic/knowledge you would apply here.

Answer 1

I’d suggest making timestamp your clustered index… since a clustered index is particularly efficient on columns that are often searched for ranges of values, and that seems to describe how you will be querying the data.

Additionally, I’m assuming that timestamp will be sequential, which would make inserting new data into the clustered index less expensive than if there were a random distribution of the data being inserted.

It doesn’t sound like you will be searching by user or by appname, so I wouldn’t recommend adding indexes to those columns unless you plan on joining on these values or using them in your where clause somewhere down the road.

You suggested adding all three fields to your index, but when you do this, the index will only be used if the “leading edge” is included in your search…

For example, if your index is (user, timestamp, appname), but you’re only searching by timestamp and appname, then that index will not be used. Because of this, its very important to consider how the data will be queried when creating your indexes.