Knowledge Management

How can I increase the acceleration maximum run time?

sansay
Contributor

In the answer I provided for this question:
http://answers.splunk.com/answers/138860/splunk-acceleration-summary-stuck-at-33.html#answer-170698

I explained that I discovered that, in my system, the acceleration process which builds a summary in the indexers, has a limited run time of 10 minutes. This was probably done because the default acceleration schedule, by design, is set to every 10 minutes.
However since we can change the schedule, and I have some queries which take too long, I would like to change the schedule so that the process runs less frequently but gets the time to complete.
The argument to change the acceleration schedule is: auto_summarize.cron_schedule.
You can add it to the savedSearch.conf in the stanza for the relevant search and set it equal to a cron schedule, like this:

auto_summarize.cron_schedule = 3,13,23,33,43,53 * * * *

But I do not know how to specify the maximum runtime of the acceleration. Does anyone know this?

sansay
Contributor

I thought I had read the help regarding this a while back. But I just took a look and there it was:

auto_summarize.max_time = 
 * The maximum amount of time that the summary search is allowed to run. Note that this is an approximate time 
 * and the summarize search will be stopped at clean bucket boundaries.
 * Defaults to: 3600

Perhaps it was added later.
Anyway, I will test this and confirm.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...

Federated Search for CloudWatch Unified Data Store Is Generally Available

As organizations modernize their cloud environments, AWS workloads generate more security, operational, and ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...