https://community.splunk.com/t5/Reporting/Creating-Incremental-Summaries-Using-Report-Acceleration/m-p/526694#M8552 <P><SPAN>Hi everyone,<BR /></SPAN><BR /><SPAN>I am trying to accelerating one savedsearch "index=main |stats count by type,severity". Now I want an accelerated summary of "All time" data for the first time only and later, every 10minutes I want to collect an incremental summary of the last 10minutes data on top of the "All time" accelerated summary. Is there any way to achieve this?<BR /></SPAN><BR /><SPAN><STRONG>Note</STRONG>: I've come across to know the auto_summarize.dispatch.earliest_time parameter which seems directly bound to "Summary range". If I keep earliest_time to -10min(Because auto_summarize.cron_schedule parameter is set to */10 * * * *) then my summary range is also changing from "Alltime" to "1 Day".</SPAN></P> Tue, 27 Oct 2020 18:55:11 GMT milanparmar541 2020-10-27T18:55:11Z https://community.splunk.com/t5/Reporting/Creating-Incremental-Summaries-Using-Report-Acceleration/m-p/526694#M8552 <P><SPAN>Hi everyone,<BR /></SPAN><BR /><SPAN>I am trying to accelerating one savedsearch "index=main |stats count by type,severity". Now I want an accelerated summary of "All time" data for the first time only and later, every 10minutes I want to collect an incremental summary of the last 10minutes data on top of the "All time" accelerated summary. Is there any way to achieve this?<BR /></SPAN><BR /><SPAN><STRONG>Note</STRONG>: I've come across to know the auto_summarize.dispatch.earliest_time parameter which seems directly bound to "Summary range". If I keep earliest_time to -10min(Because auto_summarize.cron_schedule parameter is set to */10 * * * *) then my summary range is also changing from "Alltime" to "1 Day".</SPAN></P> Tue, 27 Oct 2020 18:55:11 GMT https://community.splunk.com/t5/Reporting/Creating-Incremental-Summaries-Using-Report-Acceleration/m-p/526694#M8552 milanparmar541 2020-10-27T18:55:11Z