Other Usage

How to use time picker when using accelerated reports as base search in dashboard?

thisissplunk
Builder

I created an accelerated search that is set for 7 days retention, runs every 30 minutes and searches 30 minutes back when it runs. I set it up in my dashboard to be used as a base search like so:

 

  <search id="reportBase" ref="Accelerated report base">
          <earliest>$set_time.earliest$</earliest>
          <latest>$set_time.latest$</latest>
  </search>

 

I then attempt to use it and modify the results with tokens like so:

 

        <search base="reportBase">
          <query>| search type IN ($types$) AND account IN ($accounts$) | stats count by hostname | sort -count </query>

 

The new search modifications with tokens works. However, no matter what I do, the time picker does not work. I only ever get back the last 30 minutes of data. I thought the 7 day retention meant I could get back any amount of time up to 7 days back quickly, not just the last 30 minutes.

I tried to work around this by running this but the same thing happens:

 

| loadjob savedsearch="MyUser:search:Accelerated report base"

 

Then, I tried to use it in normal search and the time picker there also does nothing. It still only shows the last 30 minutes of data.

 

Am I missing something or can I not use accelerated reporting with a time picker?

Labels (1)
0 Karma

thisissplunk
Builder

I may be fundamentally misunderstanding how accelerated searching works. I thought I'd need to access the report or its results somehow.

What I see in my searches that use the exact same stats command is that the Job setting says "Using summaries for search"

This was not explained in any of the accelerated report documentation.

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...