Reporting

How exactly does Report, Data Acceleration, and Summary Indexing work?

aoliullah
Path Finder

How exactly does Report, Data acceleration and Summary indexing work? Could someone explain to me in layman terms please? I understand it helps maximize efficiency in searches by searching on a subset of data, making it quicker etc.

But I don't really get how it works and what people refer to when they say data summary being built in report acceleration context (i.e. Splunk software runs a background process that builds a data summary based on the results returned by the report.)

Thanks!

0 Karma
1 Solution

cmerriman
Super Champion

basically, report acceleration , in a sense, saves search results for a rolling period of time making reports and report-based dashboard panels run faster. there are caveats as far was what types of reports can be accelerated, though.
for instance, index=_internal|stats count by _timeruns every morning for a time period of 7 days. every day, the oldest day will fall off and a new day will be added.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Manageacceleratedsearchsummaries

summary indexing basically adds onto the existing data of the search you ran and is set up like a saved search.
for example, index=_internal|stats count by _timeruns every week for a time period of 7 days. those 7 days will tack onto the end of the report and you'll have much more data to work with.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usesummaryindexing

View solution in original post

cmerriman
Super Champion

basically, report acceleration , in a sense, saves search results for a rolling period of time making reports and report-based dashboard panels run faster. there are caveats as far was what types of reports can be accelerated, though.
for instance, index=_internal|stats count by _timeruns every morning for a time period of 7 days. every day, the oldest day will fall off and a new day will be added.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Manageacceleratedsearchsummaries

summary indexing basically adds onto the existing data of the search you ran and is set up like a saved search.
for example, index=_internal|stats count by _timeruns every week for a time period of 7 days. those 7 days will tack onto the end of the report and you'll have much more data to work with.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usesummaryindexing

ChrisG
Splunk Employee
Splunk Employee

There is also a good overview of the three types of acceleration in the Knowledge Manager Manual. See Overview of summary-based search and pivot acceleration.

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...