Knowledge Management

Accelerated report: status = pending?

alexiri
Communicator

Hi,

I've created a couple of accelerated reports and, after building the summary for a while, they're marked as Pending. What does this mean? It's not listed as one of the possible statuses in the documentation.

Also, how can I tell if my searches are using the summaries or not?

Cheers,
Alex

1 Solution

mattness
Splunk Employee
Splunk Employee

The "Pending" status means that the summary was last updated more than 10 minutes ago and is due to be updated again. It's basically saying that the information in the summary may be slightly outdated but will be up-to-date momentarily. Sorry this status was excluded; I'll get the docs updated.

The obvious clue that a search is using its summary is if you run it and find that its search performance has improved (it completes faster than it did before).

But if that's not enough, or if you aren't sure if there's a performance improvment, you can check the Search Job Inspector for a debug message that indicates that summaries are being used. Here's an example: DEBUG: [thething] Using summaries for search, summary_id=246B0E5B-A8A2-484E-840C-78CB43595A84_search_admin_b7a7b033b6a72b45, maxtimespan=

If you're running a search that is similar to one that you've already created a summary for you can click Turn on acceleration and if Splunk determines it is close enough to the other search it will run the new search against the other search's preexisting summary. On the Report Acceleration Summaries page in Manager you'll be able to see that both searches are being applied to the same summary. So that's one way to see exactly which searches use a particular summary.

View solution in original post

mattness
Splunk Employee
Splunk Employee

The "Pending" status means that the summary was last updated more than 10 minutes ago and is due to be updated again. It's basically saying that the information in the summary may be slightly outdated but will be up-to-date momentarily. Sorry this status was excluded; I'll get the docs updated.

The obvious clue that a search is using its summary is if you run it and find that its search performance has improved (it completes faster than it did before).

But if that's not enough, or if you aren't sure if there's a performance improvment, you can check the Search Job Inspector for a debug message that indicates that summaries are being used. Here's an example: DEBUG: [thething] Using summaries for search, summary_id=246B0E5B-A8A2-484E-840C-78CB43595A84_search_admin_b7a7b033b6a72b45, maxtimespan=

If you're running a search that is similar to one that you've already created a summary for you can click Turn on acceleration and if Splunk determines it is close enough to the other search it will run the new search against the other search's preexisting summary. On the Report Acceleration Summaries page in Manager you'll be able to see that both searches are being applied to the same summary. So that's one way to see exactly which searches use a particular summary.

ChrisG
Splunk Employee
Splunk Employee
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...