Splunk 优化之加速报表 Accelerate reports

shenghuiping2001

已于 2023-04-30 17:16:57 修改

阅读量2.8k

点赞数

分类专栏： splunk 文章标签： Splunk report Accelerate 加速报表

于 2023-04-30 17:15:23 首次发布

本文链接：https://blog.csdn.net/shenghuiping2001/article/details/130449792

版权

splunk 专栏收录该内容

204 篇文章 15 订阅 ¥39.90 ¥99.00

订阅专栏

超级会员免费看

本文介绍了Splunk报表加速功能，用于加快大量数据的报表运行速度。报表加速通过后台生成数据概要，使得搜索在下次运行时能更快完成。然而，并非所有报表都可加速，存在权限、搜索模式等限制。用户可以通过Edit Acceleration对话框选择Summary Range，如7天、3个月或All Time，以设置概要覆盖的时间范围。报告的Search Mode需设为Smart或Fast以确保加速效果。同时，文章提到了报告的调度和管理方法。

摘要由CSDN通过智能技术生成

1: 背景：

有些客户的数据比较大，这个时候就会用到报表的加速功能：

Accelerate reports

If your report has a large number of events and is slow to complete when you run it, you may be able to accelerate it so it completes faster when you run it in the future. When you accelerate a report, Splunk software runs a background process that builds a data summary based on the results returned by the report. When you next run the search, it runs against this summary rather than the full index. Because this summary is smaller than the full index and contains precomputed summary data relevant to the search, the search should complete much quicker than it did when you first ran it.

当然也不是所有的都可以加速