Splunk "Manage report acceleration" manual specifies the following:
In addition, you can have reports that technically qualify for report acceleration, but which may not be helped much by it. This is often the case with reports with high data cardinality--something you'll find when there are two or more transforming commands in the search string and the first transforming command generates many (50k+) output rows. For example:
index=* | stats count by id | stats avg(count) as avg, count as distinct_ids
My question is why acceleration won't help much in this case? If the first transforming command generates more than 50K output rows i should not be using report acceleration?
Thank you.
↧