https://community.splunk.com/t5/Splunk-Search/How-do-you-invoke-search-acceleration-for-non-saved-searches/m-p/72345#M18086 <P>Martin is right. </P> <P>When you accelerate a saved search, <CODE>auto_summarize = 1</CODE> is added to the search definition in savedsearch.conf<BR /> and the summary is updated every 10 minutes. If a search runs that would benefit from using the summary data - it will.</P> <P>Splunk doesn't interrogate the XML files for searches embedded in views, it doesnt know about them until they run, so it would have no idea to accelerate them.</P> <P>So the option is to create a saved search, and accelerate it. You can then look in the "report acceleration" tab for that saved search to see if its being accessed by your views.</P> Tue, 26 Mar 2013 19:45:32 GMT jonuwz 2013-03-26T19:45:32Z https://community.splunk.com/t5/Splunk-Search/How-do-you-invoke-search-acceleration-for-non-saved-searches/m-p/72343#M18084 <P>Ideally, I'm looking for a way to apply the search acceleration function to a search in a dashboard that is not a "saved search."</P> <P>What function or operator is actually applied to a given search when the "Accelerate this search" box is checked?</P> Fri, 22 Mar 2013 19:52:13 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-invoke-search-acceleration-for-non-saved-searches/m-p/72343#M18084 SK110176 2013-03-22T19:52:13Z https://community.splunk.com/t5/Splunk-Search/How-do-you-invoke-search-acceleration-for-non-saved-searches/m-p/72344#M18085 <P>You can save a similar search and accelerate that, just make sure it uses the same/compatible reporting command, parameters, input, span, timerange, and maybe more.</P> Fri, 22 Mar 2013 21:35:36 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-invoke-search-acceleration-for-non-saved-searches/m-p/72344#M18085 martin_mueller 2013-03-22T21:35:36Z https://community.splunk.com/t5/Splunk-Search/How-do-you-invoke-search-acceleration-for-non-saved-searches/m-p/72345#M18086 <P>Martin is right. </P> <P>When you accelerate a saved search, <CODE>auto_summarize = 1</CODE> is added to the search definition in savedsearch.conf<BR /> and the summary is updated every 10 minutes. If a search runs that would benefit from using the summary data - it will.</P> <P>Splunk doesn't interrogate the XML files for searches embedded in views, it doesnt know about them until they run, so it would have no idea to accelerate them.</P> <P>So the option is to create a saved search, and accelerate it. You can then look in the "report acceleration" tab for that saved search to see if its being accessed by your views.</P> Tue, 26 Mar 2013 19:45:32 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-invoke-search-acceleration-for-non-saved-searches/m-p/72345#M18086 jonuwz 2013-03-26T19:45:32Z