Hi
I have an accelerated data model, when I run the search like below it returns result in a few seconds.
"| datamodel Network_Traffic All_Traffic summariesonly=true search | search All_Traffic.src=x.x.x.0/24 OR All_Traffic.dest=x.x.x.0/24 "
But when I pipe it to table command query take more than an hour to complete.
"| datamodel Network_Traffic All_Traffic summariesonly=true search | search All_Traffic.src=x.x.x.0/24 OR All_Traffic.dest=x.x.x.0/24 | table All_Traffic.src"
I run both of them in last 7 days time range, What's the problem?