Report acceleration applies to reports based on qualifying transforming searches. Commands preceding the first transforming command must be streamable, and Splunk creates the acceleration summary only when the hot bucket covered by the summary range contains at least 100,000 events. The search command is streamable, so a search followed by a transforming command meets these requirements.
Community Discussion