How To Accelerate a Search (issue) ?

egid_la — Tue, 29 Sep 2020 16:33:43 GMT

Hi,

I tried turning my search into a report and accelerating it but got the " Your report doesn't qualify for acceleration" message..

Here's my search :

index=bigdata_x sourcetype="loga*"
| transaction keeporphans=t keepevicted=t IDT,PART
| search environment=* (PART=) (IDF=)
| table _time,IDF,IDT,PART,DIAGX_details,DIAGY_details,code_meaning,environment
| join IDT type=inner
[ search index=bigdata_y sourcetype="logb*"
| search (status=*)
| table Code,sender,receiver,status,IDT,IDTU,action,filename]
| table _time,sender,receiver,PART,IDF,status,action,IDT,IDTU,DIAGX_details,DIAGP_details,code_meaning,filename,Code
| where PART= receiver OR PART= sender

I'm currently running Splunk 6.5.3

How can i improve accelerate this search ?

Re: How To Accelerate a Search (issue) ?

HiroshiSatoh — Fri, 03 Nov 2017 09:18:22 GMT

See this.

https://answers.splunk.com/answers/130415/accelerate-transaction-searches.html

topic Re: How To Accelerate a Search (issue) ? in Reporting

How To Accelerate a Search (issue) ?

Re: How To Accelerate a Search (issue) ?