In a single value element, the text size always adjusted dynamically to the element's height. E.g., if you use the mouse to increase the single element's height, the text becomes larger. However, once you add the tag version="1.1" to the topmost dashboard or form element, the text size is fixed and does not adjust to changing heights any more. Reproduction In Splunk's web UI, create a new "classic" dashboard Add a single value visualization with the following search: index=_internal | timechart count Use the mouse to make the panel higher Notice how the single element's font size adjusted to the higher panel (it increased dynamically) Save the dashboard Edit the dashboard's source: change <dashboard> to <dashboard version="1.1"> Save the dashboard Refresh the page (press F5) The single element's font size is now smaller and it does not adjust to changed heights Revert the changes in the source, save the dashboard, and refresh the page The font size is adjusted correctly again A screen recording is available here: https://www.youtube.com/watch?v=M_btqoyDg2I My test environment: Splunk Enterprise 8.2.1 Chrome 92 Update 2021-09-23 Still unfixed in Splunk Enterprise 8.2.2.1 ... View more

The problem Sometimes specific events are missing from an accelerated data model. These events can be found with a regular SPL search. When searching the data model, the events are only returned when the data model is not accelerated. Once the acceleration is enabled, the events do not show up any more. Of course, we checked that the DMA's status is "100% completed". Rebuilding the accelerated data model does not help. What is really strange: it happens that events are disappearing from the accelerated data model that showed up just fine mere minutes earlier. I noticed that today when I refreshed a dashboard and some charts suddenly were empty (which led me to investigate this again and post this question). An example search Here is an example of a search that is not returning all expected events (we have noticed this issue with different datasets in the past, too): | pivot uberAgent Process_NetworkTargetPerformance count(Process_NetworkTargetPerformance) as "Event count" splitrow AppName filter host is "Client11" We have seen this issue on various versions of Splunk Enterprise 7.1.x and 7.2.x (including 7.2.1). Screenshots Screenshots of the above search, first with acceleration disabled (9 results), then with acceleration enabled (6 results): Scheduler.log I ran a search to query scheduler.log over a time range of 8 hours, which covered the time of the issue: index=_internal source=*scheduler.log | stats count by log_level Result: DEBUG: 22537 ERROR: 3 INFO: 5811 Update 2020-02-04: back in Splunk 8.x Dominik's answer fixed the problem for Splunk versions 7.x. However, it is back in Splunk 8 (we tested 8.0 and 8.0.1). ... View more