Reporting
Highlighted

Is there any benefit of creating accelerated reports on top of other accelerated reports?

Builder

I'm wondering if there is any benefit of creating accelerated reports on top of other accelerated reports?

For example:
Accelerated report 1

search | bin time span=5m | stats c as count5m by time interestingfields
Accelerated report 2

search | bin _time span=5m | stats c as count_5m by _time interesting_fields | bin _time span=1h | stats sum(count_5m) as count_1h by _time interesting_fields

Accelerated report 3

search | bin _time span=5m | stats c as count_5m by _time interesting_fields | bin _time span=1h | stats sum(count_5m) as count_1h by _time interesting_fields | bin _time span=1d | stats sum(count_1h) as count_1d by _time interesting_fields

The idea being that search #1 may be good for searches that are within the last day, search #2 being used for searches that are within the last 30 days, and search #3 being used for all time. Since they all use the same base summary, is there any benefit of doing something like this or would it be better to create 3 distinct searches so that 3 separate summaries are created (5m, 1h, 1d)?

Tags (2)
Highlighted

Re: Is there any benefit of creating accelerated reports on top of other accelerated reports?

Influencer

Likely not. You would be better off setting up summary indexing than using multiple accelerated reports with similar bases. Here are some resources:
http://www.splunk.com/view/SP-CAAACZW
http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Usesummaryindexing
http://wiki.splunk.com/Community:Summary_Indexing

View solution in original post

Highlighted

Re: Is there any benefit of creating accelerated reports on top of other accelerated reports?

Builder

Thanks for the info. It seems that accelerated reports are the preferred method for summaries, but for similar searches maybe it's more efficient to use summary indexes.

0 Karma