Hi! I try to accelerate only one dataset in datamodel with multiple datasets. How i can do it through datamodel.conf or in web ui? In webui i cant choose acceleration in edit drilldown(
I have one data model accelerated which contains 5 event datasets with simple fields conditions. Now when I try to just find out count using tstats count from datamodel=X.Y1 where source=A It d...
Hi, I wonder whether someone may be able to help me please.
Could someone possibly tell me whether it's possible to build a lookup table from the results of an "Accelerated Report"?
Many t...
...lert and at the end calculate the results of a whole week i saw that there is an option to use tabledataset my question is if tabledataset is the right option, if yes - how can i do it if not, what i...
...anging my head against the wall for a couple of days and I am hoping someone can help. So here's the deal...
If I run this search it works and genrates a table with the requested fields:
| d...
...oth table and definition are stored in the search app context, but that shouldn't matter when they are shared among all apps, right? However when i go to add a lookup field to a dataset to enrich the d...
I am trying to accelerate a dataset I created.. and it tells me I can’t because it has streaming commands.
I’m not sure if there is some better way to accelerate this dataset so its faster for g...
Hello,
I am confused about delegation for accelerated data models.
I built an accelerated table data model, and granted access to users, and also granted access to any required knowledge object....
I like splunk's pivot table capabilities and am wondering if its possible to use a scheduled search within a dataset. You may ask, why not drop in the full query from the scheduled search into the d...