Report acceleration is used to accelerate individual reports. It's easy to set up for any transforming search or report that runs over a large dataset.
Only searches that utilize transforming commands (chart , stats , timechart , top , rare ,…) --searches that transform their results into statistical tables and charts--are eligible.`enter code here`
In addition, any commands used in the search before the reporting command must be streaming commands.
We can use many way to accelerate the report:
1. After executing your search , go to save as report enter the report_name then the box appear click on acceleration and save , another box appear in which you select the summary range of your report and save .
2. We can accelerate the report that are already saved by clicking to edit acceleration in the reports page.
3. We also acceleration the reports by going to settings then Searches , reports and alerts
After you enable acceleration for your report, Splunk Enterprise will begin building a report acceleration summary for the report if it determines that the report would benefit from summarization. Thus if you want to include your report data in any other query or in your dashboard , go to settings then Reports acceleration summaries under Reports Using Summary double click to your report_name and get your report query , now use it in the dashboard search code or any other report search code that you want.
... View more