Splunk Search

[Report Acceleration] Can we benefit from the accelerated summary outside the app?

sylim_splunk
Splunk Employee
Splunk Employee

If a report is accelerated in the search app, are the other apps supposed to benefit from its acceleration? The report is shared with all app and the search app is exported to global. The reason is that I am getting the opposite behavior.

Test1. I run the saved search in the search app context, it look up the accelerated data and returns results fast.

Test2. I run the saved search in the exchange app and it is not accelerated. I am re-running the report acceleration on the app context I need, but found this behavior odd. Seems like the local.meta permissions are valid for the report share but not the summarization created by the report accel option.

So the question is... is a report is accelerated and shared, can other apps take advantage of the accelerated report?

Labels (1)
Tags (1)
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

 Your use case is not supported. It is scoped by app and will not work outside the app context.  This is by design.

In search log if it will fail to find summary id with the log..

07-22-2020 22:19:07.250 INFO dispatchRunner - search context: user="admin", app="exchange app", bs-pathname="/opt/splunk/etc"
07-22-2020 22:19:07.399 INFO DispatchThread - Did not find a usable summary_id, setting info._summary_mode=none, not modifying input summary_id=...

 

 

View solution in original post

Tags (1)

sylim_splunk
Splunk Employee
Splunk Employee

 Your use case is not supported. It is scoped by app and will not work outside the app context.  This is by design.

In search log if it will fail to find summary id with the log..

07-22-2020 22:19:07.250 INFO dispatchRunner - search context: user="admin", app="exchange app", bs-pathname="/opt/splunk/etc"
07-22-2020 22:19:07.399 INFO DispatchThread - Did not find a usable summary_id, setting info._summary_mode=none, not modifying input summary_id=...

 

 

Tags (1)
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...