The parameters for data model acceleration look good. Thanks for posting the details. Are you using Windows Add-on to bring Windows data in? Do you have it installed on your Splunk server? If you don't, you'll need it to have the data model data populated properly. If you do, do the following searches return any results? index=* app="win*" action=success tag=authentication index=* action=success tag=authentication If the searches come back empty, that is likely a problem with the Windows Add-on configuration. ... View more