Prior to updating to Splunk Enterprise 8.0.2 scheduled accelerated reports ran extremely fast: Report A Duration: 37.166 Record count: 314 After updating to Splunk Enterprise 8.0.2 the report ran extremely slow: Report A Duration: 418.621 Record count: 300 Given the patch notes for 8.0.2 – I'm not seeing any changes to acceleration or summary indexing, so is it safe to assume this is a fluke? The massive increase in report generation (job) time of the scheduled accelerated reports appears to be caused by them no longer accessing the corresponding report acceleration summary. The "Access Count" never goes up when the scheduled reports are run. Guess we'll wait for 8.0.3 to fix this. Troubleshooting steps attempted: Manually rebuild Report Acceleration Summaries Delete all affected Report Acceleration Summaries Delete and recreate affected production reports – recreated schedule and checked box for acceleration Check filesystem permissions of inputlookup csv - confirmed -rw-rw-r-- splunk splunk ... View more

Hi, I have a local admin search being sent to Splunk from Tenable IO. It lists all the machines (asset) name and each member of the local admin groups (Output). An example of the output per asset would be below The following users are members of the 'Administrators' group: - --**\administrator (User) - *--*\ABC (User) How can i get a dashboard to show every particular local admin listing all assets it has local admin access to. Thanks ... View more