Reporting

Does "Time Range" matter for Report acceleration

ctaf
Contributor

Hello,

I understand that using "Summary indexing", the Time Range is important as it can create gaps or overlaps.
But how does it work with "Report acceleration" (and "Data model acceleration" by the way)? Since Splunk creates automatically the summaries over a certain "Summary Range", is the "Time Range" field relevant?

What should I enter in the Time Range field for my example (see attachment) ?

Thanks !

woodcock
Esteemed Legend

The time-range specifies how far back to run the backfill and also how much tsidx data to keep. If you say 6 months, then an automatic backfill process will run to back-generate the tsidx for this report. If you then search older than 6 months, the benefits of acceleration will not be preset but if you still have raw data, your search will complete.

0 Karma

ctaf
Contributor

I think you're explaining "Summary Range" and not Time Range?

0 Karma

woodcock
Esteemed Legend

It has nothing to do with the acceleration. That setting has to do with the report only.

0 Karma

ctaf
Contributor

Ok, so it doesn't affect the acceleration?

woodcock
Esteemed Legend

That is correct.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...