Why is my accelerated report with a summary range of 1 year only showing 1 month of data?

[a212830]

Hi,

I have a report set up to run nightly at 1:00 am, and I have that report accelerated with a summary range of 1 year. However, I can only get 1 month of data out of the report. Why is that?

[woodcock]

Either because you only have 1 month of raw data retained or because the timerange for your report only spans 1 month. Acceleration (or lack thereof) cannot ever cause a search to return different results; it can only effect how quickly the (same) results are returned.

[a212830]

OK. Thanks. My understanding of report acceleration must be wrong - I thought report acceleration actually took the data from your search, and put it in "side buckets", allowing you to keep longer term storage for a report, without having to keep the detailed data. Is that wrong?

[sowings]

Acceleration (Report Acceleration or its cousin Data Model Acceleration) only keep the accelerated data no longer than the raw data upon which they depend.

[woodcock]

That is true of Summary Indexing which is another very different way to speed up getting results. Don't forget to close the question by clicking "Accept".

[a212830]

So, what does report acceleration do?

[woodcock]

Take a look at these links:

http://answers.splunk.com/answers/135451/summary-index-vs-report-acceleration.html#answer-295172
http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Manageacceleratedsearchsummaries