topic Re: Acceleration grayed out in Reporting

Acceleration grayed out

jairjr — Tue, 25 Apr 2017 04:15:20 GMT

Any idea why I can't enable acceleration for this simple transformation:

sourcetype=iis tag::host="aDC" OR tag::host="bDC" OR tag::host="cDC" | timechart count by tag::host

Re: Acceleration grayed out

adonio — Tue, 25 Apr 2017 17:53:32 GMT

Hello jairjr,
please read here: http://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/Manageacceleratedsearchsummaries#Restrictions_on_report_acceleration
specially this: "In addition, be careful when accelerating reports whose base searches include tags, event types, search macros, and other knowledge objects whose definitions can change independently of the report after the report is accelerated. If this happens, the accelerated report can return invalid results."

Re: Acceleration grayed out

jairjr — Tue, 25 Apr 2017 17:59:42 GMT

Hi adonio thank you for the answer, I know that using tags is not a good practice but this is just a warning, it should let me enable acceleration. Shouldn't it?

Re: Acceleration grayed out

adonio — Tue, 25 Apr 2017 18:49:42 GMT

can you enable acceleration on any search? try index = * | timechart count by host

Re: Acceleration grayed out

jairjr — Tue, 25 Apr 2017 22:21:40 GMT

Yes, I can even go to another saved report and enable it.

Re: Acceleration grayed out

jkat54 — Wed, 26 Apr 2017 01:02:01 GMT

I'm curious what happens if you try this:

sourcetype=iis 
| eval hosttag=if('tag::host'=="aDC" OR 'tag::host'=="bDC" OR 'tag::host'=="cDC"),'tag::host',null())
| timechart count by hosttag

I don't know if the single quotes around tag::host are needed or if this will even work at all. Just curious.

Re: Acceleration grayed out

jairjr — Wed, 26 Apr 2017 16:33:17 GMT

The single quotes are needed, and I was able to enable acceleration just fine, thank you. Can you let me know why this way worked?

Re: Acceleration grayed out

jairjr — Wed, 26 Apr 2017 16:41:16 GMT

But interesting, that way the hosttag var is not populated.

Re: Acceleration grayed out

jkat54 — Wed, 26 Apr 2017 17:28:15 GMT

Did it work or not?

If not, can you show me what event types make those tags? I can then craft the search without tags.

Re: Acceleration grayed out

jairjr — Wed, 26 Apr 2017 18:31:32 GMT

This worked:
sourcetype=iis | eval hosttag = if("tag::host" == "c" OR "tag::host" == "b" OR "tag::host" == "c", "tag::host", null()) | timechart count by tag::host

if I try "| timechart count by hosttag" I get a count named NULL instead.

Re: Acceleration grayed out

lguinn2 — Wed, 26 Apr 2017 20:55:18 GMT

In an eval command, the single quotes are used to enclose field names that have special characters on the right side of the equals sign (=).