Other Usage

How to use time picker when using accelerated reports as base search in dashboard?

thisissplunk
Builder

I created an accelerated search that is set for 7 days retention, runs every 30 minutes and searches 30 minutes back when it runs. I set it up in my dashboard to be used as a base search like so:

 

  <search id="reportBase" ref="Accelerated report base">
          <earliest>$set_time.earliest$</earliest>
          <latest>$set_time.latest$</latest>
  </search>

 

I then attempt to use it and modify the results with tokens like so:

 

        <search base="reportBase">
          <query>| search type IN ($types$) AND account IN ($accounts$) | stats count by hostname | sort -count </query>

 

The new search modifications with tokens works. However, no matter what I do, the time picker does not work. I only ever get back the last 30 minutes of data. I thought the 7 day retention meant I could get back any amount of time up to 7 days back quickly, not just the last 30 minutes.

I tried to work around this by running this but the same thing happens:

 

| loadjob savedsearch="MyUser:search:Accelerated report base"

 

Then, I tried to use it in normal search and the time picker there also does nothing. It still only shows the last 30 minutes of data.

 

Am I missing something or can I not use accelerated reporting with a time picker?

Labels (1)
0 Karma

thisissplunk
Builder

I may be fundamentally misunderstanding how accelerated searching works. I thought I'd need to access the report or its results somehow.

What I see in my searches that use the exact same stats command is that the Job setting says "Using summaries for search"

This was not explained in any of the accelerated report documentation.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...