I have a scheduled report that runs at minute 05 for events seen in the last hour on the hour (one full hour of data) for All Time (required for stats). The report is accelerated for All Time. The scheduled report is set with the highest scheduled priority and doesn't run concurrently with other scheduled reports or have a schedule window. After the initial summary (acceleration) is built, the job runs in about 830 seconds.
However, every subsequent report experiences a time creep of a few seconds and never returns to the initial value.
Example scheduled report generation times each hour the report runs:
Duration: 831.608
Duration: 836.902
Duration: 850.259
Duration: 854.068
Duration: 875.153
Duration: 902.589
etc.
I've confirmed the Report Acceleration Summary for this report is functioning correctly and updates every 10 minutes per the default setting.
Given this trend, Splunk will eventually take longer than an hour to generate the report. How do I prevent this from happening?
↧