Reporting

How To Accelerate a Search (issue) ?

egid_la
Explorer

Hi,

I tried turning my search into a report and accelerating it but got the " Your report doesn't qualify for acceleration" message..

Here's my search :

index=bigdata_x sourcetype="loga*"
| transaction keeporphans=t keepevicted=t IDT,PART
| search environment=* (PART=) (IDF=)
| table _time,IDF,IDT,PART,DIAGX_details,DIAGY_details,code_meaning,environment
| join IDT type=inner
[ search index=bigdata_y sourcetype="logb*"
| search (status=*)
| table Code,sender,receiver,status,IDT,IDTU,action,filename]
| table _time,sender,receiver,PART,IDF,status,action,IDT,IDTU,DIAGX_details,DIAGP_details,code_meaning,filename,Code
| where PART= receiver OR PART= sender

I'm currently running Splunk 6.5.3

How can i improve accelerate this search ?

0 Karma
1 Solution
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...