Reporting

Looking for Report Acceleration info in _internal

lguinn2
Legend

For my report acceleration summaries, I can see some statistics in the Splunk Manager. I've read the manual section on Manage Report Acceleration, so I know about the Summarization Load statistic and how it is calculated.

My question is: can I find out more about when the summarization tasks actually run behind the scenes, and how much load that is causing on my indexers? I browsed through the _internal index, but I didn't find anything obvious.

Where is creation/maintenance of report acceleration summaries logged?

Tags (1)
0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

You can look at the logs on the server for some minor bit more data about the job, or you can do a search like:

index=_audit user=yourusername

that will get you some information if you know the username but not the jobid. If you know the jobid, you can try (example shows a real jobid, but replace with the correct one for your search):

index=_audit *1375207557.136764*

You might need to cull out splunkweb accesses by adding:

...  NOT *POST* NOT *GET*

Otherwise, you can get the same information from the logs:

grep 1375207557.136764 $SPLUNKHOME/var/log/splunk

Also, I found some intersting things using:

index=_* *summary*

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

You can look at the logs on the server for some minor bit more data about the job, or you can do a search like:

index=_audit user=yourusername

that will get you some information if you know the username but not the jobid. If you know the jobid, you can try (example shows a real jobid, but replace with the correct one for your search):

index=_audit *1375207557.136764*

You might need to cull out splunkweb accesses by adding:

...  NOT *POST* NOT *GET*

Otherwise, you can get the same information from the logs:

grep 1375207557.136764 $SPLUNKHOME/var/log/splunk

Also, I found some intersting things using:

index=_* *summary*
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...