Splunk Search

Summarization timespan incongruent



I have a two environments with the exact same app and saved searches, and the exact same data

In environment 1, the summarization has timespans of 10min, 10s, 1d, 1h, 1min, 1s
In environment 2, the summarization timespans is just 1h.

Why would this happen? And why can't I, by changing the auto.summarize.timespan in the Advanced Edit of the savedsearches, actually change these to the timespans I want?

Thanks in advance

0 Karma


You are looking exactly the right place... auto_summarize.timespan in savedsearches.conf in the two environments. Are you saying that you have tried to edit taht parameter and it had no effect? Or that you were unable to edit it, or it changed itself back? What's the actual issue?


You can manually set summary timespans (but we don't recommend it)
You can set summary timespans manually at the report level in savedsearches.conf by changing the value of the auto_summarize.timespan parameter. If you do set your summary timespans manually, keep in mind that very small timespans can result in extremely slow summary creation times, especially if the summary range is long. On the other hand, large timespans can result in quick-building summaries that cannot not be used by reports with short time ranges. In almost all cases, for optimal performance and usability it's best to let Splunk software determine summary timespans.

0 Karma


What I am facing is that eventhough I use the auto.summarize.timespan with value of 10s, Splunk still gives me the 1h timespan only.

It seems splunk is ignoring that rule. It doesn't matter what value I put there, it chooses 1h as the only timespan.

I understand that the customization is not recommended and I understand the risks, but at least it shoul allow the suggested parameter to actually have effects on the timespan, which it does not!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...