Splunk Search

Summarization timespan incongruent



I have a two environments with the exact same app and saved searches, and the exact same data

In environment 1, the summarization has timespans of 10min, 10s, 1d, 1h, 1min, 1s
In environment 2, the summarization timespans is just 1h.

Why would this happen? And why can't I, by changing the auto.summarize.timespan in the Advanced Edit of the savedsearches, actually change these to the timespans I want?

Thanks in advance

0 Karma


You are looking exactly the right place... auto_summarize.timespan in savedsearches.conf in the two environments. Are you saying that you have tried to edit taht parameter and it had no effect? Or that you were unable to edit it, or it changed itself back? What's the actual issue?


You can manually set summary timespans (but we don't recommend it)
You can set summary timespans manually at the report level in savedsearches.conf by changing the value of the auto_summarize.timespan parameter. If you do set your summary timespans manually, keep in mind that very small timespans can result in extremely slow summary creation times, especially if the summary range is long. On the other hand, large timespans can result in quick-building summaries that cannot not be used by reports with short time ranges. In almost all cases, for optimal performance and usability it's best to let Splunk software determine summary timespans.

0 Karma


What I am facing is that eventhough I use the auto.summarize.timespan with value of 10s, Splunk still gives me the 1h timespan only.

It seems splunk is ignoring that rule. It doesn't matter what value I put there, it chooses 1h as the only timespan.

I understand that the customization is not recommended and I understand the risks, but at least it shoul allow the suggested parameter to actually have effects on the timespan, which it does not!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...