Reporting

How often report accelaration check the new data set in HDFS ?

melonman
Motivator

Hi

I am using Hunk and configured report acceleration saved searches. report acceleration automatically checks where there are new data sets that have not been cached.

My Question is how often the report acceleration feature checks new data set in HDFS, and its mechanism.
Is there default value of interval for report acceleration to check the new data sets?
How does the report acceleration keep track of cached/fresh data set?

Appreciated if anyone can point me to the information or readings about this.

Thank you.

1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

It defaults to every 10 minutes, but it can be set on a per saved search basis from the conf file, for more info look at savedsearches.conf. Note that there is a limit to how many report acceleration summary generating searches can run concurrently (defaults to 50% of scheduler's capacity), which means that for busy systems the 10 minute period is only a rough approximation.

auto_summarize.cron_schedule = <cron-string>
* Cron schedule to be used to probe/generate the summaries for this search

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

It defaults to every 10 minutes, but it can be set on a per saved search basis from the conf file, for more info look at savedsearches.conf. Note that there is a limit to how many report acceleration summary generating searches can run concurrently (defaults to 50% of scheduler's capacity), which means that for busy systems the 10 minute period is only a rough approximation.

auto_summarize.cron_schedule = <cron-string>
* Cron schedule to be used to probe/generate the summaries for this search
Get Updates on the Splunk Community!

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Automatic Discovery Part 2: Setup and Best Practices

In Part 1 of this series, we covered what Automatic Discovery is and why it’s critical for observability at ...