I am fairly new to Splunk. Is there a way to accelerate searches that use the 'transaction' command? Whenever I try to save this as accelerated search, it fails to save.
index=myidx sourcetype="my-logs" (jobtype OR appid) | transaction tid keepevicted=true maxspan=180 | fillnull value=null appid | stats count by jobtype, appid
... View more