Knowledge Management

How to optimize a large static historical search by getting cached results from the past and recalculating new deltas?

mgaraventa_splu
Splunk Employee
Splunk Employee

I want to run a simple search counting total number of events over a time duration such earliest = -6 months, latest = now.

Say I want to run this search on a daily basis, but obviously I don't need the past 6 months to be calculated and regenerated each time because each consecutive search is just going to add a small delta to the entire search, namely, 1 new days worth of data.

Is there a way for me to optimize this search or use some other Splunk functionality in order to get cached results from the past and just recalculate the new deltas?

Thanks.

1 Solution

mgaraventa_splu
Splunk Employee
Splunk Employee

This can be solved by following one of the 3 possible approaches listed in this documentation article:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Aboutsummaryindexing

i.e.

  1. Report acceleration - Uses automatically-created summaries to speed up completion times for certain kinds of reports.
  2. Data model acceleration - Uses automatically-created summaries to speed up completion times for pivots.
  3. Summary indexing - Enables acceleration of searches and reports through the manual creation of separate summary indexes that exist separately from your main indexes.

Hope this helps.

View solution in original post

mgaraventa_splu
Splunk Employee
Splunk Employee

This can be solved by following one of the 3 possible approaches listed in this documentation article:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Aboutsummaryindexing

i.e.

  1. Report acceleration - Uses automatically-created summaries to speed up completion times for certain kinds of reports.
  2. Data model acceleration - Uses automatically-created summaries to speed up completion times for pivots.
  3. Summary indexing - Enables acceleration of searches and reports through the manual creation of separate summary indexes that exist separately from your main indexes.

Hope this helps.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...