Reporting

Acceleration grayed out

jairjr
Path Finder

Any idea why I can't enable acceleration for this simple transformation:

sourcetype=iis tag::host="aDC" OR tag::host="bDC" OR tag::host="cDC" | timechart count by tag::host

0 Karma
1 Solution

jairjr
Path Finder

This worked:
sourcetype=iis | eval hosttag = if("tag::host" == "c" OR "tag::host" == "b" OR "tag::host" == "c", "tag::host", null()) | timechart count by tag::host

if I try "| timechart count by hosttag" I get a count named NULL instead.

View solution in original post

0 Karma

jairjr
Path Finder

This worked:
sourcetype=iis | eval hosttag = if("tag::host" == "c" OR "tag::host" == "b" OR "tag::host" == "c", "tag::host", null()) | timechart count by tag::host

if I try "| timechart count by hosttag" I get a count named NULL instead.

0 Karma

lguinn2
Legend

In an eval command, the single quotes are used to enclose field names that have special characters on the right side of the equals sign (=).

0 Karma

jkat54
SplunkTrust
SplunkTrust

I'm curious what happens if you try this:

sourcetype=iis 
| eval hosttag=if('tag::host'=="aDC" OR 'tag::host'=="bDC" OR 'tag::host'=="cDC"),'tag::host',null())
| timechart count by hosttag

I don't know if the single quotes around tag::host are needed or if this will even work at all. Just curious.

jairjr
Path Finder

The single quotes are needed, and I was able to enable acceleration just fine, thank you. Can you let me know why this way worked?

0 Karma

jairjr
Path Finder

But interesting, that way the hosttag var is not populated.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Did it work or not?

If not, can you show me what event types make those tags? I can then craft the search without tags.

0 Karma

adonio
Ultra Champion

Hello jairjr,
please read here: http://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/Manageacceleratedsearchsummaries#Restric...
specially this: "In addition, be careful when accelerating reports whose base searches include tags, event types, search macros, and other knowledge objects whose definitions can change independently of the report after the report is accelerated. If this happens, the accelerated report can return invalid results."

jairjr
Path Finder

Hi adonio thank you for the answer, I know that using tags is not a good practice but this is just a warning, it should let me enable acceleration. Shouldn't it?

0 Karma

adonio
Ultra Champion

can you enable acceleration on any search? try index = * | timechart count by host

0 Karma

jairjr
Path Finder

Yes, I can even go to another saved report and enable it.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...