How can I increase the acceleration maximum run time?

sansay — Mon, 28 Sep 2020 17:43:17 GMT

In the answer I provided for this question:
http://answers.splunk.com/answers/138860/splunk-acceleration-summary-stuck-at-33.html#answer-170698

I explained that I discovered that, in my system, the acceleration process which builds a summary in the indexers, has a limited run time of 10 minutes. This was probably done because the default acceleration schedule, by design, is set to every 10 minutes.
However since we can change the schedule, and I have some queries which take too long, I would like to change the schedule so that the process runs less frequently but gets the time to complete.
The argument to change the acceleration schedule is: auto_summarize.cron_schedule.
You can add it to the savedSearch.conf in the stanza for the relevant search and set it equal to a cron schedule, like this:

auto_summarize.cron_schedule = 3,13,23,33,43,53 * * * *

But I do not know how to specify the maximum runtime of the acceleration. Does anyone know this?

Re: How can I increase the acceleration maximum run time?

sansay — Fri, 26 Sep 2014 23:40:14 GMT

I thought I had read the help regarding this a while back. But I just took a look and there it was:

auto_summarize.max_time = 
 * The maximum amount of time that the summary search is allowed to run. Note that this is an approximate time 
 * and the summarize search will be stopped at clean bucket boundaries.
 * Defaults to: 3600

Perhaps it was added later.
Anyway, I will test this and confirm.

topic Re: How can I increase the acceleration maximum run time? in Knowledge Management

How can I increase the acceleration maximum run time?

Re: How can I increase the acceleration maximum run time?