I'm wondering if there is any benefit of creating accelerated reports on top of other accelerated reports?
For example:
Accelerated report 1
search | bin _time span=5m | stats c as count_5m by _time interesting_fields
Accelerated report 2
search | bin _time span=5m | stats c as count_5m by _time interesting_fields | bin _time span=1h | stats sum(count_5m) as count_1h by _time interesting_fields
Accelerated report 3
search | bin _time span=5m | stats c as count_5m by _time interesting_fields | bin _time span=1h | stats sum(count_5m) as count_1h by _time interesting_fields | bin _time span=1d | stats sum(count_1h) as count_1d by _time interesting_fields
The idea being that search #1 may be good for searches that are within the last day, search #2 being used for searches that are within the last 30 days, and search #3 being used for all time. Since they all use the same base summary, is there any benefit of doing something like this or would it be better to create 3 distinct searches so that 3 separate summaries are created (5m, 1h, 1d)?
Likely not. You would be better off setting up summary indexing than using multiple accelerated reports with similar bases. Here are some resources:
http://www.splunk.com/view/SP-CAAACZW
http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Usesummaryindexing
http://wiki.splunk.com/Community:Summary_Indexing
Likely not. You would be better off setting up summary indexing than using multiple accelerated reports with similar bases. Here are some resources:
http://www.splunk.com/view/SP-CAAACZW
http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Usesummaryindexing
http://wiki.splunk.com/Community:Summary_Indexing
Thanks for the info. It seems that accelerated reports are the preferred method for summaries, but for similar searches maybe it's more efficient to use summary indexes.