Search Optimization

Course structure

Module 1 – Optimizing Search

• Understand how search modes affect performance
• Examine the role of the Splunk Search Scheduler
• Review general search practices

Module 2 – Report Acceleration

• Define acceleration and acceleration types
• Understand report acceleration and create an accelerated report
• Reveal when and how report acceleration summaries are created
• Search against acceleration summaries

Module 3 – Data Model Acceleration

• Understand data model acceleration
• Accelerate a data model
• Use the datamodel command to search data models

Module 4 – Using the tstats Command

• Explore the tstats command
• Search acceleration summaries with tstats
• Search data models with tstats
• Compare tstats and stats