Reporting

Is there any benefit of creating accelerated reports on top of other accelerated reports?

sc0tt
Builder

I'm wondering if there is any benefit of creating accelerated reports on top of other accelerated reports?

For example:
Accelerated report 1

search | bin _time span=5m | stats c as count_5m by _time interesting_fields
Accelerated report 2

search | bin _time span=5m | stats c as count_5m by _time interesting_fields | bin _time span=1h | stats sum(count_5m) as count_1h by _time interesting_fields

Accelerated report 3

search | bin _time span=5m | stats c as count_5m by _time interesting_fields | bin _time span=1h | stats sum(count_5m) as count_1h by _time interesting_fields | bin _time span=1d | stats sum(count_1h) as count_1d by _time interesting_fields

The idea being that search #1 may be good for searches that are within the last day, search #2 being used for searches that are within the last 30 days, and search #3 being used for all time. Since they all use the same base summary, is there any benefit of doing something like this or would it be better to create 3 distinct searches so that 3 separate summaries are created (5m, 1h, 1d)?

Tags (2)
1 Solution

masonmorales
Influencer

Likely not. You would be better off setting up summary indexing than using multiple accelerated reports with similar bases. Here are some resources:
http://www.splunk.com/view/SP-CAAACZW
http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Usesummaryindexing
http://wiki.splunk.com/Community:Summary_Indexing

View solution in original post

masonmorales
Influencer

Likely not. You would be better off setting up summary indexing than using multiple accelerated reports with similar bases. Here are some resources:
http://www.splunk.com/view/SP-CAAACZW
http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Usesummaryindexing
http://wiki.splunk.com/Community:Summary_Indexing

sc0tt
Builder

Thanks for the info. It seems that accelerated reports are the preferred method for summaries, but for similar searches maybe it's more efficient to use summary indexes.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...