Splunk® Enterprise

Splunk Analytics for Hadoop

Download manual as PDF

Download topic as PDF

Accelerate reports

Report acceleration lets you speed up searches by using cached data you create ahead of time. Report acceleration is used to accelerate individual reports and is easy to set up for any transforming search or report that runs over a large dataset.

  • To enable report acceleration you click a checkbox and select a time range. Everything after that happens behind the scenes. Subsequent runs of accelerated reports complete faster.
  • Splunk Analytics for Hadoop automatically shares report acceleration summaries with similar searches so that those searches can benefit from already gathered data.
  • Report acceleration provides automatic backfill: if for some reason you have a data interruption, Splunk Analytics for Hadoop automatically updates or rebuilds your summaries.
  • Report acceleration summaries are stored in Splunk Analytics for Hadoop for your virtual indexes.

Note: At this time the Verify button is not available for Splunk Analytics for Hadoop report acceleration.

It's important to note that report acceleration does not work for all types of searches.

  • Accelerated searches are not effective in verbose mode.

To enable report acceleration when you save a report

1. On the Reports page, expand a row for a report and click Edit to open the Edit Acceleration dialog.

2. Select "Accelerate Report" in the Edit Acceleration dialog. Select the range of time over which you plan to run the report and click Save.

3. In Settings > Searches and reports open the detail page for the report.

4. Click Accelerate this search and set a Summary range.

Learn more about report acceleration

See the following topics in the Splunk Enterprise documentation:

Maintain report acceleration

Report Acceleration creates and saves search summaries that Splunk Analytics for Hadoop then leverages to speed up completion times for certain kinds of reports. This means that your caches can become rather large. To learn about where to locate and configure your cache, and how to efficiently manage cache maintenance and cleanup, see Configure report acceleration caching.

Last modified on 22 March, 2018
PREVIOUS
Search a virtual index
  NEXT
Manage report acceleration

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.1.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters