Hello Guys
I have a question regarding data models
I have a data that's parsed in splunk using cim compatible add-ons
I need to make a dashboard for all changes in the system so I used the change data model and made a dashboard panels using this spl
| from datamodel "Change.Auditing_Changes"
| from datamodel "Change.Endpoint_Changes" ...etc
but its very very slow so I made the Change data model accelerated with summary range 1 year
but nothing changed it still slow
could anyone help me with this
