Reporting

Report acceleration pending

tcoq
Path Finder

Hi together,

I tried to use report acceleration but it seems to be that is not working.

In "Report Acceleration Summaries" my Summary Status is always "Pending".

I tried to modify my report to a very simple form but it is also "Pending":

index="live_bu_*" Action="initial entry" | SourceToCountry | rename source AS Land | rename count AS Sessions | stats count as Session by Land

Any ideas why it is always "Pending"?

Best regards
Steffen

Tags (1)
0 Karma

tcoq
Path Finder

Hi,

I find the soulution:

Accelaration is not working with * on index!

BR
Steffen

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...