Should accelerated reports always be scheduled?

[kiril123]

I have created an accelerated report with a summary range of 1 day. Should i also schedule this report with the cron schedule to run lets say hourly?

If accelerated report is not scheduled, how splunk is going to build summary in this case?

[lfedak_splunk]

Hey @kiril123, if @inventsekar answered your question please don't forget to "Accept" his answer to award karma points and close the post. 🙂

[inventsekar · Accepted solution]

Report Acceleration need not be scheduled (looks like splunk internally manages this scheduling part).

more on Report Acceleration -
http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Manageacceleratedsearchsummaries

from Splunk Operational Intelligence Cookbook
By Josh Diakun, Paul R Johnson, Derek Mock

[kiril123]

Thank you for your answer. Do you know how splunk builds the summary when the report is unscheduled? Does it run a job lets say every 5 min?

[inventsekar]

How Splunk Enterprise builds report acceleration summaries
When you enable acceleration for an eligible report and Splunk Enterprise determines that it will build a summary for the report, it begins running the report to populate the summary with data. When the summary is complete, Splunk Enterprise continues running the report on a 10 minute interval to keep the summary up to date. Each update ensures that the entire configured time range is covered without a significant gap in data. This method of summary building also ensures that late-arriving data will be summarized without complication.