I am fairly new to Splunk. Is there a way to accelerate searches that use the 'transaction' command? Whenever I try to save this as accelerated search, it fails to save.
index=myidx sourcetype="my-logs" (jobtype OR appid) | transaction tid keepevicted=true maxspan=180 | fillnull value=null appid | stats count by jobtype, appid
That search does not qualify for Report Acceleration due to the non-streaming
transaction command being used before the first transforming command (
Without knowing the data or your requirements for the result, same way as speeding up any other search. Filter as much as possible as early as possible, restrict timeranges, consider summarizing searches, etc.