If your report has a large number of events and is slow to complete when you run it, you may be able to accelerate it so it completes faster when you run it in the future.
How does Splunk Enterprise accelerate the report? When you accelerate a report, Splunk Enterprise runs a background process that builds a data summary based on the results returned by the report. When you next run the search, Splunk Enterprise runs it against this summary rather than the full index. Because this summary is smaller than the full index and contains precomputed summary data relevant to the search, the search should complete much quicker than it did when you first ran it.
You created it though Pivot. Pivot reports are accelerated via data model acceleration. See "Manage data models" in the Knowledge Manager Manual.
When you save a search as a report, you'll be brought to a Your Report Has Been Created dialog, where you can choose from three optional "Additional Settings" options. Click the Acceleration option to open the Edit Acceleration dialog.
Note: The data summaries discussed here operate on principles similar to those of traditional summary indexes, but that's where their resemblance ends. The data summaries that are created for report acceleration purposes are not summary indexes. For more information about report acceleration and summary indexing, and information about why one might prefer one method over the other, see "About report acceleration and summary indexing" in the Knowledge Manager Manual.
For example, if you choose a Summary Range of 7 Days, you're saying that going forward you want Splunk Enterprise to build and maintain a summary that always covers at least the last seven days. As time passes, Splunk Enterprise will delete data from this summary that is older than seven days while it continues to summarize incoming new data.
The same goes for the other Summary Range settings. Choose 1 Month if you plan to run the report over time ranges that are fall within the last 30 days. Choose 1 Year if you anticipate that you'll need to run the search over time ranges that fall within the past year. Keep in mind that larger summaries take longer for Splunk Enterprise to generate at first and will consume more storage resources.
Report acceleration only works for reports that have Search Mode set to Smart or Fast. If you select the Verbose search mode for a report that has been accelerated, it will run as slow as it would if it were not accelerated at all. For more information about the Search Mode settings, see "Set search mode to adjust your search experience" in the Search Manual.
The base search cannot use a transforming command (such as chart, timechart, stats, and top).
If the base search has commands before the transforming command, they must be streaming commands. Nonstreaming commands are allowed after the first transforming command.
The base search must run in the smart or fast search mode. If you save the report in verbose mode and accelerate it, Splunk Enterprise automatically changes the search mode to smart or fast. You cannot change the search mode of a report that has already been accelerated to verbose.
We provide examples of qualifying and non-qualifying searches in "Manage report acceleration," in the Knowledge Manager Manual.
Splunk Enterprise provides a Manager page for this feature at Manager > Report Acceleration Summaries. On this page you can review the report summaries to which you have access. You can see the reports that apply to them, view their build progress, verify their consistency, rebuild them when they are damaged, delete summaries that are obsolete or which are taking up needed space, and more.
It's important to note that as the number of summaries in use by your implementation stacks up, you may encounter storage and performance impacts. This is because search acceleration summaries require storage space, and to keep them updated Splunk Enterprise has to run searches in the background on new data every 10 minutes. The Report Acceleration Summaries page enables you to quickly identify summaries that are taking up more space than they are worth, given the frequency of their use.
For more information about report acceleration, including an explanation of what is happening behind the scenes, a discussion of summary storage and performance considerations, and more tips on summary management with the Report Acceleration Summaries page, see "Manage report acceleration," in the Knowledge Manager Manual.