Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Why does appending an accelerated saved search...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
2 searches to illustrate:
| noop | stats count | append [ savedsearch my_accel_search ]
| savedsearch my_accel_search | append [ noop | stats count ]
The second runs in less than 20% of the time. Also of interest, the 2nd case has lots of notices about using summary search info in the job inspector. The first does not.
No, this isn't my actual use case. But it illustrates the problem I'm having using a saved search in a dashboard. It makes the acceleration useless because it takes so long to run.
Edit: The report acceleration summaries page does not increment the count in the case of search 1. Search 2 does. Based on the evidence, I'm thinking acceleration doesn't play with subsearches, joins or appends. Expected?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Appears to be a bug, or maybe "by design". Previously reported here:
https://answers.splunk.com/answers/170424/when-i-try-to-use-an-accelerated-report-with-a-joi.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Appears to be a bug, or maybe "by design". Previously reported here:
https://answers.splunk.com/answers/170424/when-i-try-to-use-an-accelerated-report-with-a-joi.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Apparently an old issue: https://answers.splunk.com/answers/170424/when-i-try-to-use-an-accelerated-report-with-a-joi.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's better practice to link to the old post rather than re-animating it with a comment.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
