topic If summary searches run every 5 minutes, can a non-summary search be merged with the summary to fill-in the most recent 5 minutes? in Splunk Search

If summary searches run every 5 minutes, can a non-summary search be merged with the summary to fill-in the most recent 5 minutes?

subtrakt — Mon, 28 Sep 2020 18:00:09 GMT

Summary searches occur every 5 mins but for those who need more immediate results can a non-summary search be merged with the summary to fill-in the most recent 5 mins? Would this make a difference in efficiency for a scheduled search that searches an hour back?

index=weblog_summary latest=-5m@m HTTP_RESPONSE="40*" URL="" | append [|search index="weblog" earliest=-5m@m HTTP_RESPONSE="40" URL="*"]

Re: If summary searches run every 5 minutes, can a non-summary search be merged with the summary to fill-in the most recent 5 minutes?

martin_mueller — Wed, 22 Oct 2014 20:30:53 GMT

That sounds very much like report acceleration / data model acceleration. Both ways accelerate a search every X minutes and load the most recent minutes on the fly transparently without the user noticing.

As for the question itself, sure - just remember to apply whatever reporting happened to the summary search in the last-five-minutes-search as well.