Knowledge Management

Accelerated report: status = pending?

alexiri
Communicator

Hi,

I've created a couple of accelerated reports and, after building the summary for a while, they're marked as Pending. What does this mean? It's not listed as one of the possible statuses in the documentation.

Also, how can I tell if my searches are using the summaries or not?

Cheers,
Alex

1 Solution

mattness
Splunk Employee
Splunk Employee

The "Pending" status means that the summary was last updated more than 10 minutes ago and is due to be updated again. It's basically saying that the information in the summary may be slightly outdated but will be up-to-date momentarily. Sorry this status was excluded; I'll get the docs updated.

The obvious clue that a search is using its summary is if you run it and find that its search performance has improved (it completes faster than it did before).

But if that's not enough, or if you aren't sure if there's a performance improvment, you can check the Search Job Inspector for a debug message that indicates that summaries are being used. Here's an example: DEBUG: [thething] Using summaries for search, summary_id=246B0E5B-A8A2-484E-840C-78CB43595A84_search_admin_b7a7b033b6a72b45, maxtimespan=

If you're running a search that is similar to one that you've already created a summary for you can click Turn on acceleration and if Splunk determines it is close enough to the other search it will run the new search against the other search's preexisting summary. On the Report Acceleration Summaries page in Manager you'll be able to see that both searches are being applied to the same summary. So that's one way to see exactly which searches use a particular summary.

View solution in original post

mattness
Splunk Employee
Splunk Employee

The "Pending" status means that the summary was last updated more than 10 minutes ago and is due to be updated again. It's basically saying that the information in the summary may be slightly outdated but will be up-to-date momentarily. Sorry this status was excluded; I'll get the docs updated.

The obvious clue that a search is using its summary is if you run it and find that its search performance has improved (it completes faster than it did before).

But if that's not enough, or if you aren't sure if there's a performance improvment, you can check the Search Job Inspector for a debug message that indicates that summaries are being used. Here's an example: DEBUG: [thething] Using summaries for search, summary_id=246B0E5B-A8A2-484E-840C-78CB43595A84_search_admin_b7a7b033b6a72b45, maxtimespan=

If you're running a search that is similar to one that you've already created a summary for you can click Turn on acceleration and if Splunk determines it is close enough to the other search it will run the new search against the other search's preexisting summary. On the Report Acceleration Summaries page in Manager you'll be able to see that both searches are being applied to the same summary. So that's one way to see exactly which searches use a particular summary.

ChrisG
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...