Reporting

Why does running an accelerated saved search work for a large time period ("All Time") but not with smaller ones ("10h")?

TiagoTLD1
Communicator

Hello,

Here is what I am facing: I have an accelerated saved search, with All Time summary range, and Timespans 10min, 1d, 1h, 1mon

When calling it to All Time, it runs immediately. When calling it for 2 days period, it still does.

When calling it with a 10h period, it takes a lot longer, although job inspections shows it actually accesses the summaries...

Could someone explain that ?

0 Karma

TiagoTLD1
Communicator

Hello,

Well I don't understand why would Splunk use the 10minute summaries if I have a Timespan of 1h. Splunk should use ten 1hour summaries to return the search results, and not use the 10minute summaries...

Do you have an answer for that?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...