- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I have created an accelerated report with a summary range of 1 day. Should i also schedule this report with the cron schedule to run lets say hourly?
If accelerated report is not scheduled, how splunk is going to build summary in this case?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Report Acceleration need not be scheduled (looks like splunk internally manages this scheduling part).
more on Report Acceleration -
http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Manageacceleratedsearchsummaries
from Splunk Operational Intelligence Cookbook
By Josh Diakun, Paul R Johnson, Derek Mock
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hey @kiril123, if @inventsekar answered your question please don't forget to "Accept" his answer to award karma points and close the post. 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Report Acceleration need not be scheduled (looks like splunk internally manages this scheduling part).
more on Report Acceleration -
http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Manageacceleratedsearchsummaries
from Splunk Operational Intelligence Cookbook
By Josh Diakun, Paul R Johnson, Derek Mock
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thank you for your answer. Do you know how splunk builds the summary when the report is unscheduled? Does it run a job lets say every 5 min?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

How Splunk Enterprise builds report acceleration summaries
When you enable acceleration for an eligible report and Splunk Enterprise determines that it will build a summary for the report, it begins running the report to populate the summary with data. When the summary is complete, Splunk Enterprise continues running the report on a 10 minute interval to keep the summary up to date. Each update ensures that the entire configured time range is covered without a significant gap in data. This method of summary building also ensures that late-arriving data will be summarized without complication.
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
