Reporting

Why am I not able to disable acceleration of reports?

ben_leung
Builder

In http://docs.splunk.com/Documentation/Splunk/6.0.5/Knowledge/Manageacceleratedsearchsummaries

It says:
"your permissions don't enable you to accelerate reports. Your role must have the schedule_search and accelerate_search capabilities."

I have a role that has the "schedule_search" capability enabled. There is no such thing as "accelerate_search" capability in version 6.0.5.
I added that in any ways and gave it the value disabled. This role is still able to accelerate reports.

How can I disable acceleration for reports? Reason is because they cause load on our servers, and our users accelerate unknowingly of the consequences. Is the only way to to disable the feature by removing the buttons for acceleration?

Tags (1)
1 Solution

mattness
Splunk Employee
Splunk Employee

Apologies for your confusion, Ben--that was a typo. You are correct that the accelerate_search capability does not exist in v 6.0.5. It was introduced in v6.1, and the documentation should have been fixed so it gave the correct information for the correct version at that time. In v6.0 the only capability required for report acceleration is schedule_search. If you remove schedule_search from the role, the ability to accelerate reports should be removed from users with that role.

In v6.1 and later, the ability to accelerate reports requires both schedule_search and accelerate_search.

I've updated the topic so it shows the correct capability requirements for 6.0.x and 6.1+

View solution in original post

mattness
Splunk Employee
Splunk Employee

Apologies for your confusion, Ben--that was a typo. You are correct that the accelerate_search capability does not exist in v 6.0.5. It was introduced in v6.1, and the documentation should have been fixed so it gave the correct information for the correct version at that time. In v6.0 the only capability required for report acceleration is schedule_search. If you remove schedule_search from the role, the ability to accelerate reports should be removed from users with that role.

In v6.1 and later, the ability to accelerate reports requires both schedule_search and accelerate_search.

I've updated the topic so it shows the correct capability requirements for 6.0.x and 6.1+

ben_leung
Builder

Thanks for notifying me. So there is no way of disabling acceleration of reports without losing the scheduling capability?

My goal is to allow a role to schedule searches, without the ability to accelerate them.

0 Karma

mattness
Splunk Employee
Splunk Employee

Not in 6.0, unfortunately. That's why the additional capability was added in v6.1--with that you can take away report acceleration and still schedule searches.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...