topic Re: Why doesn’t the report qualify for report acceleration? in Reporting

Why doesn’t the report qualify for report acceleration?

ddrillic — Thu, 25 Apr 2019 20:10:08 GMT

We have a report such as -

index=<index name>
            (  URI=<a certain uri> OR 
               URI=<a certain uri> OR 
               URI=<a certain uri> ....
            )
| dedup <field name>
| rename <fields>
| eval <new time field>=_time
| table <fields>
| fillnull

Why wouldn’t it qualify for report acceleration?

Re: Why doesn’t the report qualify for report acceleration?

codebuilder — Thu, 25 Apr 2019 22:17:57 GMT

Your query is not using any transforming/streaming commands and therefore does not qualify. You need to use stats, timechart, etc.

This section has more detailed information:
https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/Aboutsummaryindexing

Re: Why doesn’t the report qualify for report acceleration?

ddrillic — Thu, 25 Apr 2019 23:14:44 GMT

Great, is there a way to convert the table command to a streaming command?

Re: Why doesn’t the report qualify for report acceleration?

codebuilder — Mon, 29 Apr 2019 14:06:48 GMT

You can perform an eval on one of the fields being returned, or add stats, timechart, etc. Any of those should make it qualify.