Accelerate reports

Splunk Analytics for Hadoop reaches End of Life on January 31, 2025.

Report acceleration lets you speed up searches by using cached data you create ahead of time. Report acceleration is used to accelerate individual reports and is easy to set up for any transforming search or report that runs over a large dataset.

• To enable report acceleration you click a checkbox and select a time range. Everything after that happens behind the scenes. Subsequent runs of accelerated reports complete faster.
• Splunk Analytics for Hadoop automatically shares report acceleration summaries with similar searches so that those searches can benefit from already gathered data.
• Report acceleration provides automatic backfill: if for some reason you have a data interruption, Splunk Analytics for Hadoop automatically updates or rebuilds your summaries.
• Report acceleration summaries are stored in Splunk Analytics for Hadoop for your virtual indexes.

Note: At this time the Verify button is not available for Splunk Analytics for Hadoop report acceleration.

It's important to note that report acceleration does not work for all types of searches.

• Only searches that utilize transforming commands--searches that transform their results into statistical tables and charts-- are eligible. Any commands used in the search before the transforming command must be streaming commands. For more information about transforming searches, see About reporting commands.

• Accelerated searches are not effective in verbose mode.

To enable report acceleration when you save a report

1. On the Reports page, expand a row for a report and click Edit to open the Edit Acceleration dialog.

2. Select "Accelerate Report" in the Edit Acceleration dialog. Select the range of time over which you plan to run the report and click Save.

3. In Settings > Searches and reports open the detail page for the report.

4. Click Accelerate this search and set a Summary range.

Learn more about report acceleration

See the following topics in the Splunk Enterprise documentation:

• Accelerate reports in the Splunk Enterprise Reporting Manual.

• Manage report acceleration in the Splunk Knowledge Manager manual.

Maintain report acceleration

Report Acceleration creates and saves search summaries that Splunk Analytics for Hadoop then leverages to speed up completion times for certain kinds of reports. This means that your caches can become rather large. To learn about where to locate and configure your cache, and how to efficiently manage cache maintenance and cleanup, see Configure report acceleration caching.