Splunk 优化之加速报表 Accelerate reports

1: 背景：

有些客户的数据比较大，这个时候就会用到 报表的加速功能：

Accelerate reports

If your report has a large number of events and is slow to complete when you run it, you may be able to accelerate it so it completes faster when you run it in the future. When you accelerate a report, Splunk software runs a background process that builds a data summary based on the results returned by the report. When you next run the search, it runs against this summary rather than the full index. Because this summary is smaller than the full index and contains precomputed summary data relevant to the search, the search should complete much quicker than it did when you first ran it.

当然也不是所有的都可以加速，下面就列出来一些限制：

Restrictions on report acceleration

You cannot accelerate a report if:

• You created it though Pivot. Pivot reports are accelerated v