The Report Archives • Room 2

Scheduling & Acceleration

Scheduled reports run automatically at defined intervals (e.g., every hour, daily at midnight). The results are cached so users see data instantly without waiting for the search to run.

Report acceleration pre-computes summaries of your data. When you enable acceleration, Splunk builds summary data in the background, making future searches dramatically faster.

Acceleration is best for searches that use transforming commands like `stats`, `chart`, or `timechart` over large time ranges.

A search suited for acceleration

index=web_logs | stats count by status, uri_path | sort -count

Only accelerate reports that are run frequently over large time ranges. Acceleration uses additional storage.

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Drag items to their correct zone (or tap item then tap zone on mobile)

Runs at defined time intervals

Pre-computes data summaries

Caches results after each run

Best for transforming commands over large datasets

Scheduled Report

Accelerated Report