Reporting

How exactly does Report, Data Acceleration, and Summary Indexing work?

aoliullah
Path Finder

How exactly does Report, Data acceleration and Summary indexing work? Could someone explain to me in layman terms please? I understand it helps maximize efficiency in searches by searching on a subset of data, making it quicker etc.

But I don't really get how it works and what people refer to when they say data summary being built in report acceleration context (i.e. Splunk software runs a background process that builds a data summary based on the results returned by the report.)

Thanks!

0 Karma
1 Solution

cmerriman
Super Champion

basically, report acceleration , in a sense, saves search results for a rolling period of time making reports and report-based dashboard panels run faster. there are caveats as far was what types of reports can be accelerated, though.
for instance, index=_internal|stats count by _timeruns every morning for a time period of 7 days. every day, the oldest day will fall off and a new day will be added.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Manageacceleratedsearchsummaries

summary indexing basically adds onto the existing data of the search you ran and is set up like a saved search.
for example, index=_internal|stats count by _timeruns every week for a time period of 7 days. those 7 days will tack onto the end of the report and you'll have much more data to work with.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usesummaryindexing

View solution in original post

cmerriman
Super Champion

basically, report acceleration , in a sense, saves search results for a rolling period of time making reports and report-based dashboard panels run faster. there are caveats as far was what types of reports can be accelerated, though.
for instance, index=_internal|stats count by _timeruns every morning for a time period of 7 days. every day, the oldest day will fall off and a new day will be added.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Manageacceleratedsearchsummaries

summary indexing basically adds onto the existing data of the search you ran and is set up like a saved search.
for example, index=_internal|stats count by _timeruns every week for a time period of 7 days. those 7 days will tack onto the end of the report and you'll have much more data to work with.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usesummaryindexing

ChrisG
Splunk Employee
Splunk Employee

There is also a good overview of the three types of acceleration in the Knowledge Manager Manual. See Overview of summary-based search and pivot acceleration.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...