Its important to note that not all searches qualify

•
It's important to note that not all searches qualify for report acceleration. Only
searches that utilize transforming commands --searches that transform their
results into statistical tables and charts--are eligible. In addition, any commands
used in the search before the transforming command must be streaming
commands . This limitation is related to the fact that the summaries are built at
the index level rather than the search head.
In Splunk Web, you can enable report acceleration for an eligible search when
you save it as a report. You can enable report acceleration for an eligible existing
report by:
On the Reports page, expanding a row for a report and clicking Edit to
open the Edit Acceleration dialog . If your report qualifies for acceleration
and your permissions allow for report acceleration, the Edit Acceleration
dialog will display a checkbox labeled Accelerate Report. Select it. The
Summary Range field should appear. Select the range of time over which
you plan to run the report, then click Save .
•
in Settings > Searches and reports opening the detail page for a report,
clicking Accelerate this search and setting a Summary range .
•
366

See Accelerate reports.
You use the Report acceleration summaries page in System to review and
manage the summaries created through report acceleration.
See Manage report acceleration . This topic also explains how summaries work
and includes examples of qualifying and non-qualifying searches.
When should I use report acceleration?
Report acceleration is good for just about any slow-completing report that has
100k or more hot bucket events and which meets the qualifying conditions
outlined above.
Data model acceleration
You use data model acceleration to accelerate all of the fields defined in a data
model. When a data model is accelerated, any pivot or report generated by that
data model should complete much quicker than it would without the acceleration,
even if the data model represents a significantly large dataset.
There are two types of data model acceleration, ad hoc and persistent. Ad hoc
acceleration applies to a single dataset, is run over all time, and exists for the
duration of a user's pivot session, while persistent acceleration is turned on by an
admin, happens in the background, and can be scoped to shorter time ranges
such as a week or a month. Persistent acceleration is used any time a search is
run against a dataset in an acceleration-enabled data model.
Data model acceleration makes use of Splunk's high performance analytics store
(HPAS) technology, which, in a manner similar to that of report acceleration,
builds summaries alongside the buckets in your indexes. Also like report
acceleration, persistent data model acceleration is easy to enable; you just click
a checkbox for the data model you want to accelerate and select a summary
range. Once you do this, Splunk software starts building a summary that spans
the indicated range. When the summary is complete, any pivot, report, or
dashboard panel that uses an accelerated data model dataset will run against the
summary rather than the full array of
_raw
whenever possible, and result return
time should be improved by a significant amount.