Reporting

Why does running an accelerated saved search work for a large time period ("All Time") but not with smaller ones ("10h")?

TiagoTLD1
Communicator

Hello,

Here is what I am facing: I have an accelerated saved search, with All Time summary range, and Timespans 10min, 1d, 1h, 1mon

When calling it to All Time, it runs immediately. When calling it for 2 days period, it still does.

When calling it with a 10h period, it takes a lot longer, although job inspections shows it actually accesses the summaries...

Could someone explain that ?

0 Karma

TiagoTLD1
Communicator

Hello,

Well I don't understand why would Splunk use the 10minute summaries if I have a Timespan of 1h. Splunk should use ten 1hour summaries to return the search results, and not use the 10minute summaries...

Do you have an answer for that?

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...