How do you invoke search acceleration for non-saved searches?

[SK110176]

Ideally, I'm looking for a way to apply the search acceleration function to a search in a dashboard that is not a "saved search."

What function or operator is actually applied to a given search when the "Accelerate this search" box is checked?

[martin_mueller]

You can save a similar search and accelerate that, just make sure it uses the same/compatible reporting command, parameters, input, span, timerange, and maybe more.

[jonuwz]

Martin is right.

When you accelerate a saved search, auto_summarize = 1 is added to the search definition in savedsearch.conf
and the summary is updated every 10 minutes. If a search runs that would benefit from using the summary data - it will.

Splunk doesn't interrogate the XML files for searches embedded in views, it doesnt know about them until they run, so it would have no idea to accelerate them.

So the option is to create a saved search, and accelerate it. You can then look in the "report acceleration" tab for that saved search to see if its being accessed by your views.