...ndexes to report accelerations. The primary concern with summary indexes is the fact that they can lose their integrity easily and it’s a manual effort which requires precision work to restore the i...
How exactly does Report, Data acceleration and Summary indexing work? Could someone explain to me in layman terms please? I understand it helps maximize efficiency in searches by searching on a s...
I am trying to make a summary index for data in April 2014.
Using the current default search and joins, and to query more than 25 GB of data takes more than 35 seconds of time.
I want to use a...
...summary.
How can I make the report accelerationsummary work in all apps?
To illustrate what I'm seeing, here's a screenshot of the Job Monitor showing the very same search (configured i...
...eb.url="/display*") by Web.src Web.user
Only if I leave 1 condition or remove summariesonly=t from the search it will return results.
When I remove one of conditions I get 4K+ results, when I...
Hello all,
I'm trying to migrate from tscollect to data model acceleration, and running into a challenge. I'm looking at Splunk search logs, and want to find the sum(total_run_time) groupby search...
Hello splunk users,
I have some new-by questions about accelerated reports. I have accelerated a report simply by clicking on "Accelerate Report".
Good! It works!
With Report Acceleration, t...
...ill give me the output above.
Now below are the options available to me when setting up this summary indexing.
Based on what I have said so far, can anyone advise what settings I have to work w...
...icense master.
2014-11-22 07:31:23.402 +0000 splunkd started (build 237341)
terminate called after throwing an instance of 'DatabaseDirectoryManagerException'
what(): idx=summary bucket=d...