Knowledge Management

How can I increase the acceleration maximum run time?

sansay
Contributor

In the answer I provided for this question:
http://answers.splunk.com/answers/138860/splunk-acceleration-summary-stuck-at-33.html#answer-170698

I explained that I discovered that, in my system, the acceleration process which builds a summary in the indexers, has a limited run time of 10 minutes. This was probably done because the default acceleration schedule, by design, is set to every 10 minutes.
However since we can change the schedule, and I have some queries which take too long, I would like to change the schedule so that the process runs less frequently but gets the time to complete.
The argument to change the acceleration schedule is: auto_summarize.cron_schedule.
You can add it to the savedSearch.conf in the stanza for the relevant search and set it equal to a cron schedule, like this:

auto_summarize.cron_schedule = 3,13,23,33,43,53 * * * *

But I do not know how to specify the maximum runtime of the acceleration. Does anyone know this?

sansay
Contributor

I thought I had read the help regarding this a while back. But I just took a look and there it was:

auto_summarize.max_time = 
 * The maximum amount of time that the summary search is allowed to run. Note that this is an approximate time 
 * and the summarize search will be stopped at clean bucket boundaries.
 * Defaults to: 3600

Perhaps it was added later.
Anyway, I will test this and confirm.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...