Reporting

How to use report acceleration

sibanandapani1
Explorer

I have scheduled a search with report acceleration of All_time. And also verified in report acceleration tab its getting the disk space.
But now how will I use the report acceleration benefit... How will I include this report data in any other query or in my Dashboard?

Please help in resolving this.

Tags (2)

chimell
Motivator
        Report acceleration is used to accelerate individual reports. It's easy to set up for any transforming search or report that runs over a large dataset.   
       Only searches that utilize transforming commands  (chart , stats , timechart , top , rare ,…) --searches that transform their  results into statistical tables and charts--are eligible.`enter code here`
       In addition, any commands used in the search before the reporting command must be streaming commands.
We can use many way to accelerate the report:
      1.  After executing  your search , go to save as  report enter the report_name then the box appear click on acceleration and  save , another box appear in which you select the summary range of your report and save .
      2. We can accelerate the report that are already saved by clicking to edit acceleration in the reports page.
      3. We also acceleration the reports by going to settings then Searches , reports and alerts 

      After you enable acceleration for your report, Splunk Enterprise will begin building a report acceleration summary for the report if it determines that the report would benefit from summarization. Thus if you want to include  your report data in any other query or in your dashboard , go to settings then Reports acceleration summaries under  Reports Using Summary double click to your report_name and get your report query , now use it in the dashboard search code or any other report search code  that you want.
0 Karma

ChrisG
Splunk Employee
Splunk Employee

To start at the beginning, have you read the documentation about report acceleration? Report acceleration only works with transforming searches (using chart, timechart, top, or stats, for example). See the documentation for more information about the kinds of searches that you can accelerate.

If you have a transforming search that meets the requirements, and you save it as a report and enable acceleration, Splunk Enterprise will build the report acceleration summary and the next time you run the report, it should run faster. You can confirm that the summary has been built by looking at Settings > Report acceleration summaries.

Also, if you are using all time, and you have a lot of data, it could take a long time to build the summary, and you might not see as much improvement in speed. Report acceleration works best with a time window.

martin_mueller
SplunkTrust
SplunkTrust

Any search that is run that matches the report acceleration will use the report acceleration.

To verify, you should see something like "using summary " at the top of the job inspector.

0 Karma

sibanandapani1
Explorer

Thanks for your information.
Yes I have went through the details. And i have confirmed that the summary has been built by looking at Settings > Report acceleration summaries.

Now how will I run the report next time? is it directly query or scheduled search and what should be the syntax.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...