Report scheduling/acceleration question...

[a212830]

Hi,

I need to generate a number of reports about license utilization for different customers, over the past 30 days. Do I need to re-run the past 30 days search every day, or is there a way to run it for one day, and have a history that keeps building? Running it every day for 30 days seems like a waste of resources...

[martin_mueller]

You could enable report acceleration for your report to avoid re-running over old days again and again.
You could use the existing license usage data model or a custom one, accelerate that, and build your 30-day reports off that accelerated data model.
You could run a summary search every day to build the report for yesterday, and run your 30-day reports off that summary index.

[martin_mueller]

The first one is the easiest to build - save the report with a time range of 30 days, check the "accelerate" box, select 30 days, save, done. Splunk does the rest underneath.

http://docs.splunk.com/Documentation/Splunk/6.5.2/Report/Acceleratereports

[kiril123]

Do you need to schedule report as well?

[leonphelps_s]

No, its like a rolling 30 day window.

[a212830]

For the first one, how does that work in practice? I want to report on 30 days, but not have my search query the past 30 days every time.