Is there any benefit of creating accelerated reports on top of other accelerated reports?

[sc0tt]

I'm wondering if there is any benefit of creating accelerated reports on top of other accelerated reports?

For example:
Accelerated report 1

search | bin _time span=5m | stats c as count_5m by _time interesting_fields
Accelerated report 2

search | bin _time span=5m | stats c as count_5m by _time interesting_fields | bin _time span=1h | stats sum(count_5m) as count_1h by _time interesting_fields

Accelerated report 3

search | bin _time span=5m | stats c as count_5m by _time interesting_fields | bin _time span=1h | stats sum(count_5m) as count_1h by _time interesting_fields | bin _time span=1d | stats sum(count_1h) as count_1d by _time interesting_fields

The idea being that search #1 may be good for searches that are within the last day, search #2 being used for searches that are within the last 30 days, and search #3 being used for all time. Since they all use the same base summary, is there any benefit of doing something like this or would it be better to create 3 distinct searches so that 3 separate summaries are created (5m, 1h, 1d)?

[masonmorales · Accepted solution]

Likely not. You would be better off setting up summary indexing than using multiple accelerated reports with similar bases. Here are some resources:
http://www.splunk.com/view/SP-CAAACZW
http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Usesummaryindexing
http://wiki.splunk.com/Community:Summary_Indexing

[sc0tt]

Thanks for the info. It seems that accelerated reports are the preferred method for summaries, but for similar searches maybe it's more efficient to use summary indexes.