Knowledge Management

How can I increase the acceleration maximum run time?

sansay
Contributor

In the answer I provided for this question:
http://answers.splunk.com/answers/138860/splunk-acceleration-summary-stuck-at-33.html#answer-170698

I explained that I discovered that, in my system, the acceleration process which builds a summary in the indexers, has a limited run time of 10 minutes. This was probably done because the default acceleration schedule, by design, is set to every 10 minutes.
However since we can change the schedule, and I have some queries which take too long, I would like to change the schedule so that the process runs less frequently but gets the time to complete.
The argument to change the acceleration schedule is: auto_summarize.cron_schedule.
You can add it to the savedSearch.conf in the stanza for the relevant search and set it equal to a cron schedule, like this:

auto_summarize.cron_schedule = 3,13,23,33,43,53 * * * *

But I do not know how to specify the maximum runtime of the acceleration. Does anyone know this?

sansay
Contributor

I thought I had read the help regarding this a while back. But I just took a look and there it was:

auto_summarize.max_time = 
 * The maximum amount of time that the summary search is allowed to run. Note that this is an approximate time 
 * and the summarize search will be stopped at clean bucket boundaries.
 * Defaults to: 3600

Perhaps it was added later.
Anyway, I will test this and confirm.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...