Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Re: Does "Time Range" matter for Report accelerati...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does "Time Range" matter for Report acceleration
Hello,
I understand that using "Summary indexing", the Time Range is important as it can create gaps or overlaps.
But how does it work with "Report acceleration" (and "Data model acceleration" by the way)? Since Splunk creates automatically the summaries over a certain "Summary Range", is the "Time Range" field relevant?
What should I enter in the Time Range field for my example (see attachment) ?
Thanks !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The time-range specifies how far back to run the backfill and also how much tsidx data to keep. If you say 6 months, then an automatic backfill process will run to back-generate the tsidx for this report. If you then search older than 6 months, the benefits of acceleration will not be preset but if you still have raw data, your search will complete.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think you're explaining "Summary Range" and not Time Range?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It has nothing to do with the acceleration. That setting has to do with the report only.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok, so it doesn't affect the acceleration?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That is correct.
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
