five minute summaries for splunk app for vmware

[matthew_tiffany]

I was wondering if there was anyway to get the five minute summaries instead of the 20 sec perf data for splunk app for vmware?

[sdaniels · Accepted solution]

There is currently no way to modify the current default of 20 second intervals. In a future release we may allow this to be configurable.

Can you help us understand why you'd like 5 minute summaries? Are you concerned about performance within your current architecture given the lower granularity or something like that?

[jwells]

Hi,

I bring up this solved question because I have the very same problem on my Splunk instance. Was the feature you mention ever introduced?

Thank you

[matthew_tiffany]

I am not currently using summary indexing, or report acceleration, I will look into them though. My search is normally run using the java api.

[sdaniels]

Ok thanks. Are you currently using summary indexing or report acceleration to speed up your historical search? You should be able to improve your time on your search significantly!

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Aboutsummaryindexing

[matthew_tiffany]

mainly for my application 20 second intervals are not needed, and with the current data store that splunk is installed it takes hours to run a search for a whole month. I am currently using it for getting usage data.