Reporting

Why does running an accelerated saved search work for a large time period ("All Time") but not with smaller ones ("10h")?

TiagoTLD1
Communicator

Hello,

Here is what I am facing: I have an accelerated saved search, with All Time summary range, and Timespans 10min, 1d, 1h, 1mon

When calling it to All Time, it runs immediately. When calling it for 2 days period, it still does.

When calling it with a 10h period, it takes a lot longer, although job inspections shows it actually accesses the summaries...

Could someone explain that ?

0 Karma

TiagoTLD1
Communicator

Hello,

Well I don't understand why would Splunk use the 10minute summaries if I have a Timespan of 1h. Splunk should use ten 1hour summaries to return the search results, and not use the 10minute summaries...

Do you have an answer for that?

0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...