I have been pulling my hair out on this one all day. I have an accelerated data model that has two data sets: hostInfo networkInfo They are stand alone root searches. They do happen to share some fields like hostname. When running the searches in a normal splunk search window work perfectly fine. Example:       index=summary_host_info search_name="Host_Info" | fields hostname os cpu       However, only the first data set ever returns results from tstats. I've tested and swapped the two around. Example of a simple query I've been using to test:       | tstats count("hostInfo.hostname") FROM datamodel="endpoint_info" WHERE nodename="hostInfo"        There are no required fields, permissions seem fine and the data model summary is 10% built at around 1gb. I can even recreate the same data set and use that as the second one and that second identical data set will not return results.   Edit: I finally found a warning after clicking on "Datasets" at the top and clicking into one specifically:   Issue occurred with data model 'test.s3jaytest'. Issue: 'Failed to generate dmid' Reason: 'Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel'. Failed to parse options. Clearing out read-summary arguments.   What does this mean and how do I fix it? I'm using root searches, not root events.   ... View more

I have a nested json element that gives back up to 8 field names. I table them like:   | table "Config.DiskBrandSize.*"   Which has child elements like:   Barracuda: 100gb Seagate: 50gb Sandisk: 150gb    I then sum them up:   | chart sum("Config.DiskBrandSize.*")   and I get a table with columns like "sum(Config.DiskBrandSize{}.Sandisk)". But I want to rename that to just something like "SandiskTotal" which is created from the column name + "Total", NOT do manual renames. I can't figure out how to do this with a foreach either. ... View more

I'm counting up the hits to my website's specific URI's over each day. I'm using chart because I have to bucket by _time for other reasons related to how the data is dumped from a db into splunk:     | bucket span=1d _time | chart count(uri) as uris by _time domain       This works fine. But what I'd like to do now is be able to dynamically choose one of the URI's as a chart overlay and show its total percentage of the hits vs the total for the day. I can't figure out how to do this. Is there a way to access the | addtotals "Total" field but for only one column/URI? Or what about using tokens in the search and rerunning the search as I pick different URI's to overlay? Or....? I got the idea from this: https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/SearchTutorial/Chartoverlays but I need to figure out how to calculate the percentages dynamically and against | addtotals "Total" ... View more

I want to count up my aws resources by region, and show it like a heatmap. How do I table it in a way where my account IDs are going down the left, the aws regions are going across the top, and the table is the count of of events for the specific combination? There are some heatmap apps but they require time to be on the x axis which is not what I want here. ... View more

I have a simple accelerated report that looks like this:   index=hosts | stats count by hostname ip   I now want to dashboard that but use a timechart. However, timechart doesn't work because _time wasn't included in the stats count by section. index=hosts | stats count by hostname ip | timechart span=1d count I can't just add _time to the stats section in the accelerated report because it increase the amount of rows 1000x fold. I assume creating the accelerated report with timechart will cause the same 1000x issue. So is there a way around this with accelerated reports that won't cause my accelerated summary to grow 1000x? How an I access the _time? I'm feeling like it's not possible and that this is a better scenario for traditional summary indexing. Am I wrong? ... View more

If my index rolls off data at 30 days, and I run an accelerated report every day to build a summary for that day, will the summary have data going back a year eventually? Or is it limited to 30 days because of my index setting? ... View more