Dashboards & Visualizations

Why does my Splunk 6.3.2 dashboard sometimes return incorrect results when I configure a saved search with acceleration?

htkwan
Path Finder

Hello,

I found that my dashboard returns incorrect result sometimes when I configure the saved search with acceleration. I notice that this happens when the dashboard returns the results quickly (w/o the search progress bar). Works okay when I uncheck "acceleration" for the saved search. Any ideas?

0 Karma

woodcock
Esteemed Legend

Acceleration is facilitated by an ongoing extra-indexing step that must also be back-propagated. This backlog work takes time so you must give it time to do this work. Go ahead and accelerate it and try waiting a while for the backlog to work and then do a small search (last 15 minutes).

htkwan
Path Finder

Hello Woodcock,
Will try. Thanks.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...