https://community.splunk.com/t5/Reporting/How-to-confirm-a-search-is-using-auto-summarized-data-Report/m-p/51665#M1105 <P>Hi All,</P> <P>I have a search like below which is using "Report Acceleration" (Retention 7days). Even though the Report Acceleration Summary saying reporting is being accelerated, I am not seeing any visible improvement in report generation.</P> <PRE><CODE>index="accesslog" status="200" | stats count by client_ip service | geoip client_ip </CODE></PRE> <P>Is there anyway other-way to confirm that the search is using the auto accelerated summery for generating results/report. Does "Job Inspector" show this information ?</P> <P>Any advise will be well appreciated.</P> <P>Thanks</P> <P>KK</P> Fri, 31 May 2013 01:32:06 GMT KarunK 2013-05-31T01:32:06Z https://community.splunk.com/t5/Reporting/How-to-confirm-a-search-is-using-auto-summarized-data-Report/m-p/51665#M1105 <P>Hi All,</P> <P>I have a search like below which is using "Report Acceleration" (Retention 7days). Even though the Report Acceleration Summary saying reporting is being accelerated, I am not seeing any visible improvement in report generation.</P> <PRE><CODE>index="accesslog" status="200" | stats count by client_ip service | geoip client_ip </CODE></PRE> <P>Is there anyway other-way to confirm that the search is using the auto accelerated summery for generating results/report. Does "Job Inspector" show this information ?</P> <P>Any advise will be well appreciated.</P> <P>Thanks</P> <P>KK</P> Fri, 31 May 2013 01:32:06 GMT https://community.splunk.com/t5/Reporting/How-to-confirm-a-search-is-using-auto-summarized-data-Report/m-p/51665#M1105 KarunK 2013-05-31T01:32:06Z https://community.splunk.com/t5/Reporting/How-to-confirm-a-search-is-using-auto-summarized-data-Report/m-p/51666#M1106 <P>You can examine details about the summary using the Report Acceleration Summaries page in Manager, and you can verify the summary from that page as well. See <A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Manageacceleratedsearchsummaries">Manage accelerated search summaries</A> in the Knowledge Manager Manual for more information.</P> Fri, 31 May 2013 04:29:00 GMT https://community.splunk.com/t5/Reporting/How-to-confirm-a-search-is-using-auto-summarized-data-Report/m-p/51666#M1106 ChrisG 2013-05-31T04:29:00Z https://community.splunk.com/t5/Reporting/How-to-confirm-a-search-is-using-auto-summarized-data-Report/m-p/51667#M1107 <P>A much better way to confirm that you are indeed using the accelerated summary was shown to me by Fred at Splunk tech support. <BR /> 1. After your run a search at the web interface, click on the Save button, then select "Save and share results..."</P> <OL> <LI>This will show you a dialog with the link to the results. Copy the job ID numbers, from "sid=" to &amp; (ampersand)</LI> <LI>Close</LI> <LI>Open the Job management dialog by clicking on Jobs</LI> <LI>Paste the job ID in the search field, this should bring it in the list</LI> <LI>Click on Inspect: you should see a dialog open with Debug statements like this: DEBUG: [your-host-name] Using summaries for search, summary_id=DB9A5532-6493-4FD4-97F6-C454AFF89D57_search_username_68c6a0bd6570ee2b, maxtimespan=</LI> <LI>the number "68c6a0bd6570ee2b" should match the summary ID of your accelerated search which you can see by clicking on Manager, then Report Acceleration Summaries</LI> </OL> Thu, 19 Dec 2013 00:51:56 GMT https://community.splunk.com/t5/Reporting/How-to-confirm-a-search-is-using-auto-summarized-data-Report/m-p/51667#M1107 sansay 2013-12-19T00:51:56Z