Knowledge Management

How can I increase the acceleration maximum run time?

sansay
Contributor

In the answer I provided for this question:
http://answers.splunk.com/answers/138860/splunk-acceleration-summary-stuck-at-33.html#answer-170698

I explained that I discovered that, in my system, the acceleration process which builds a summary in the indexers, has a limited run time of 10 minutes. This was probably done because the default acceleration schedule, by design, is set to every 10 minutes.
However since we can change the schedule, and I have some queries which take too long, I would like to change the schedule so that the process runs less frequently but gets the time to complete.
The argument to change the acceleration schedule is: auto_summarize.cron_schedule.
You can add it to the savedSearch.conf in the stanza for the relevant search and set it equal to a cron schedule, like this:

auto_summarize.cron_schedule = 3,13,23,33,43,53 * * * *

But I do not know how to specify the maximum runtime of the acceleration. Does anyone know this?

sansay
Contributor

I thought I had read the help regarding this a while back. But I just took a look and there it was:

auto_summarize.max_time = 
 * The maximum amount of time that the summary search is allowed to run. Note that this is an approximate time 
 * and the summarize search will be stopped at clean bucket boundaries.
 * Defaults to: 3600

Perhaps it was added later.
Anyway, I will test this and confirm.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...