I am setting Splunk ES and sending data from Fortinet. Data is well parsed and CIM compatible however Network dashboards are not loaded.
After digging in macros I found that a particular command is stopping the dashboards to load.
Below is the query when I expanded all the macros.
| tstats prestats=true local=tstats_local summariesonly=true allowoldsummaries=allow_old_summaries_bool count from datamodel=NetworkTraffic.AllTraffic where * by time,AllTraffic.action span=10m
| timechart minspan=10m count by AllTraffic.action
If I change summariesonly to false then dashboards are loaded well. I read that summariesonly=true will only work if the datamodel is accelerated and in this case it is already accelerated and hence should work.