Acceleration not working...

[dcasey]

Struggling with this query in Splunk ES. The results come back fine but take a long time to generate. Tried to accelerate it but got an error stating that it can't be accelerated. I have many accelerated queries that use the timechart command (a requirement for accelerated reports), but they were all on Splunk base. First time trying to do this on the ES installation. Any ideas on what is preventing it from being accelerated?

FYI - The query is intended to look back 12 months (year to date) and display a vertical graph of all events closed by severity in ES.

notable | search status_label="Closed" OR status_label="Resolved" | eval severity_status=severity.":".status_label | fillnull value="unknown" | timechart span=1mon count by severity_status | rename "informational:Closed" AS "Informational","low:Closed" AS "Low","medium:Closed" AS "Medium","high:Closed" AS "High","critical:Closed" AS "Critical"

[xwang_splunk]

either find a way to remove your |fillnull pipe, or adding a list of fields to your |fillnull pipe. Then the check can pass.

[sowings]

In short, because the acceleration of searches look to reduce the overall result set, and certain search commands disqualify a search for acceleration. In this case, there's a lot packed into that `notable` macro which is doing a lot of per-event filtration / eval, etc. Because of all of that per event manipulation, the parser knows that it can't effectively accelerate the search.

Further, the place that gets you to having the "status_label" field is also jammed with macro goodness. In particular we have to consult several lookups to ascertain the current state of the event; this isn't indexed data at this point, so it's also not a candidate for acceleration.

There may be a way, however, to short-circuit some of the parts of that query to get you to what you want more directly. I'll do some fiddling on my local instance and see what I can come up with.