Reporting

Why does running an accelerated saved search work for a large time period ("All Time") but not with smaller ones ("10h")?

TiagoTLD1
Communicator

Hello,

Here is what I am facing: I have an accelerated saved search, with All Time summary range, and Timespans 10min, 1d, 1h, 1mon

When calling it to All Time, it runs immediately. When calling it for 2 days period, it still does.

When calling it with a 10h period, it takes a lot longer, although job inspections shows it actually accesses the summaries...

Could someone explain that ?

0 Karma

TiagoTLD1
Communicator

Hello,

Well I don't understand why would Splunk use the 10minute summaries if I have a Timespan of 1h. Splunk should use ten 1hour summaries to return the search results, and not use the 10minute summaries...

Do you have an answer for that?

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...