I have scheduled a search with report acceleration of All_time. And also verified in report acceleration tab its getting the disk space.
But now how will I use the report acceleration benefit... How will I include this report data in any other query or in my Dashboard?
Please help in resolving this.
Report acceleration is used to accelerate individual reports. It's easy to set up for any transforming search or report that runs over a large dataset.
Only searches that utilize transforming commands (chart , stats , timechart , top , rare ,…) --searches that transform their results into statistical tables and charts--are eligible.`enter code here`
In addition, any commands used in the search before the reporting command must be streaming commands.
We can use many way to accelerate the report:
1. After executing your search , go to save as report enter the report_name then the box appear click on acceleration and save , another box appear in which you select the summary range of your report and save .
2. We can accelerate the report that are already saved by clicking to edit acceleration in the reports page.
3. We also acceleration the reports by going to settings then Searches , reports and alerts
After you enable acceleration for your report, Splunk Enterprise will begin building a report acceleration summary for the report if it determines that the report would benefit from summarization. Thus if you want to include your report data in any other query or in your dashboard , go to settings then Reports acceleration summaries under Reports Using Summary double click to your report_name and get your report query , now use it in the dashboard search code or any other report search code that you want.
To start at the beginning, have you read the documentation about report acceleration? Report acceleration only works with transforming searches (using chart, timechart, top, or stats, for example). See the documentation for more information about the kinds of searches that you can accelerate.
If you have a transforming search that meets the requirements, and you save it as a report and enable acceleration, Splunk Enterprise will build the report acceleration summary and the next time you run the report, it should run faster. You can confirm that the summary has been built by looking at Settings > Report acceleration summaries.
Also, if you are using all time, and you have a lot of data, it could take a long time to build the summary, and you might not see as much improvement in speed. Report acceleration works best with a time window.
Any search that is run that matches the report acceleration will use the report acceleration.
To verify, you should see something like "using summary " at the top of the job inspector.
Thanks for your information.
Yes I have went through the details. And i have confirmed that the summary has been built by looking at Settings > Report acceleration summaries.
Now how will I run the report next time? is it directly query or scheduled search and what should be the syntax.