Acceleration

Splunk searches are fast. They can pull millions of events in a relatively small amount of time. But what happens when you need to search billions of events? Or what if you want the daily statistics of a website over 5 years? This is where some methods of acceleration will give you an advantage over raw data. Acceleration "summarizes" your data, and provides you with aggregated statistics that can be looked up faster. If your App doesn't collect that much data, or you don't care about long-term statistics, you might not need any form of acceleration.

Summary indexing

Summary indexing is a tested but true method of collecting aggregated data. One way is to set up the summary fields and place them in the index using the collect command.

Tip

Summary indexing does not count towards your daily license usage, so feel free to summarize as much data as you wish!

Let's start with the report manager. Before we begin configuring the summary index, we have to decide...

Tech Concepts

Programming languages

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Splunk Developer?s Guide

By : Smith

Splunk Developer?s Guide

By: Smith

Overview of this book

Acceleration

Summary indexing

Tip

Splunk Developer?s Guide

By : Smith

Splunk Developer?s Guide

By: Smith

Overview of this book

Acceleration

Summary indexing

Tip

Confirmation

Buy this book with your credits?

Submit Your Feedback

Create a Free Account To Continue Reading

Sign in to activate your 7-day free access