Reporting
Highlighted

Why am I not able to disable acceleration of reports?

Builder

In http://docs.splunk.com/Documentation/Splunk/6.0.5/Knowledge/Manageacceleratedsearchsummaries

It says:
"your permissions don't enable you to accelerate reports. Your role must have the schedulesearch and acceleratesearch capabilities."

I have a role that has the "schedulesearch" capability enabled. There is no such thing as "acceleratesearch" capability in version 6.0.5.
I added that in any ways and gave it the value disabled. This role is still able to accelerate reports.

How can I disable acceleration for reports? Reason is because they cause load on our servers, and our users accelerate unknowingly of the consequences. Is the only way to to disable the feature by removing the buttons for acceleration?

Tags (1)
Highlighted

Re: Why am I not able to disable acceleration of reports?

Splunk Employee
Splunk Employee

Apologies for your confusion, Ben--that was a typo. You are correct that the acceleratesearch capability does not exist in v 6.0.5. It was introduced in v6.1, and the documentation should have been fixed so it gave the correct information for the correct version at that time. In v6.0 the only capability required for report acceleration is schedulesearch. If you remove schedule_search from the role, the ability to accelerate reports should be removed from users with that role.

In v6.1 and later, the ability to accelerate reports requires both schedulesearch and acceleratesearch.

I've updated the topic so it shows the correct capability requirements for 6.0.x and 6.1+

View solution in original post

Highlighted

Re: Why am I not able to disable acceleration of reports?

Builder

Thanks for notifying me. So there is no way of disabling acceleration of reports without losing the scheduling capability?

My goal is to allow a role to schedule searches, without the ability to accelerate them.

0 Karma
Highlighted

Re: Why am I not able to disable acceleration of reports?

Splunk Employee
Splunk Employee

Not in 6.0, unfortunately. That's why the additional capability was added in v6.1--with that you can take away report acceleration and still schedule searches.