Does the summarization start from scratch when it is updated for report acceleration? Or is it just updating "new data" that has not been summarized yet?
Thanks in advance
The software runs the report on a periodic basis to update the summary and keep it current. See "How the Splunk platform builds report acceleration summaries" in the Knowledge Manager Manual.
View solution in original post