Update savedsearches.conf

Author: gjanders

default/savedsearches.conf

@@ -7593,7 +7593,7 @@ disabled = 1
 action.email.useNSSubject = 1
 alert.track = 0
 cron_schedule = 38 * * * *
-description = Report only? Yes. As found on Clara-Fication: Finding and Improving Expensive Searches, https://conf.splunk.com/files/2022/slides/PLA1162B.pdf / https://conf.splunk.com/files/2022/recordings/PLA1162B_1080.mp4. Run on the search head with the DMA
+description = Report only? Yes. As found on Clara-Fication: Finding and Improving Expensive Searches, https://conf.splunk.com/files/2022/slides/PLA1162B.pdf / https://conf.splunk.com/files/2022/recordings/PLA1162B_1080.mp4. Run on the search head with the DMA. Also refer to SearchHeadLevel - Datamodel access summary for a more detailed view.
 dispatch.earliest_time = -65m@m
 dispatch.latest_time = -5m@m
 display.events.fields = ["index","sourcetype","host"]
@@ -8787,7 +8787,7 @@ search = | rest /servicesNS/-/-/saved/searches count=0 search="disabled=0" searc
 action.email.useNSSubject = 1
 alert.track = 0
 cron_schedule = 38 * * * *
-description = Report only? Yes. This report is based on the query in Splunk community slack provided by Ismo Soutamo. This query returns a summary of datamodels, acceleration status and if accelerated, access count and time.
+description = Report only? Yes. This report is based on the query in Splunk community slack provided by Ismo Soutamo. This query returns a summary of datamodels, acceleration status and if accelerated, access count and time. Similar to SearchHeadLevel - Accelerated DataModels Access Info. Run on the search head with DMA enabled.
 dispatch.earliest_time = -65m@m
 dispatch.latest_time = -5m@m
 display.events.fields = ["index","sourcetype","host"]
@@ -8800,12 +8800,12 @@ search =  | rest splunk_server=local timeout=60 /servicesNS/-/-/datamodel/model
 | search acceleration = "*true*" \
 | eval DM="tstats:DM_" . 'eai:acl.app' . "_" . title \
 | join DM type=outer \
-    [| rest splunk_server=local timeout=60 /servicesNS/-/-/admin/summarization by_tstats=1 f=summary.access_count f=summary.access_time \
+    [| rest splunk_server=local timeout=60 /servicesNS/-/-/admin/summarization by_tstats=1 f=summary.access_count f=summary.access_time f=summary.size \
     | search summary.access_count > 0 \
-    | table title summary.access_count summary.access_time \
+    | table title summary.access_count summary.access_time summary.size \
     | rename title as DM] \
 | spath input=acceleration \
 | rename eai:acl.* -> *\
 | rename enabled AS acceleration_enabled\
-| table title author app summary.access_count summary.access_time perms.read sharing updated acceleration_enabled earliest_time, cron_schedule, max_time, backfill_time, max_concurrent, allow_skew, allow_old_summaries\
+| table title author app summary.access_count summary.access_time summary.size perms.read sharing updated acceleration_enabled earliest_time, cron_schedule, max_time, backfill_time, max_concurrent, allow_skew, allow_old_summaries\
 | eval summary.access_time=strftime('summary.access_time', "%+")