I've got a dashboard in which the panels depend on accelerated reports. When building these reports, I've let them run once on 00:00 using scheduling. The next couple of days, these dashboards are extremely fast. However, I have to turn of scheduling because I want users to be able to use a time picker in my dashboard. After a couple of days, my dashboard panels have to be loaded all over again when an user wants to see the dashboard. Because the underlaying data consists of approx 10M events, this takes about half an hour. From what I read on Splunk Answers and Splunk Docs, accelerated reports are filled every 10 minutes. My report acceleration summary page, however, shows for all of my reports that the summary is not updated for the last 8 days, when I ran the complete search for the last time. What I want, is users to be able to use a time-picker on my dashboards and have results displayed immediately after they make their selection, just like the dashboard would behave just after running the report manually. Does anybody know how to achieve this? Thank you very much in advance! ... View more

I've got a very large dataset which has got 50 M events each month. I've currently got 3 months indexed, so approx 150M events. Now, when I try to build up an accelerated report it still has got nearly 2M events. This is the least possible as I still need to use quite a lot of files that have unique combinations in the data. What would be best practice to build up a search on this data? Searches have to be over all-time data. We also have built this in ES. Here, it only takes about 1 minute to show a result over the full 3 months worth of data. ... View more

I would like to see the possibility of showing percentage values on the y-axis of my charts (so 1% to 100%). Currently, it's only possible to show numbers without the formatting within Splunk, whereas other packages like Tableau already have many of these functionalities. ... View more

I've got a problem with my XML input. I've tried several settings, but can't seem to find the right ones.. Here's a sample of my data: <?xml version="1.0" encoding="UTF-8"?> <ActueleVertrekTijden> <VertrekkendeTrein> <RitNummer>781</RitNummer> <VertrekTijd>2017-03-24T22:04:00+0100</VertrekTijd> <VertrekVertraging>PT7M</VertrekVertraging> <VertrekVertragingTekst>+7 min</VertrekVertragingTekst> <EindBestemming>Groningen</EindBestemming> <TreinSoort>Intercity</TreinSoort> <RouteTekst>A'dam Zuid, Almere C., Lelystad C.</RouteTekst> <Vervoerder>NS</Vervoerder> <VertrekSpoor wijziging="false">1-2</VertrekSpoor> </VertrekkendeTrein> <VertrekkendeTrein> <RitNummer>11683</RitNummer> <VertrekTijd>2017-03-24T22:05:00+0100</VertrekTijd> <EindBestemming>Amersfoort Schothorst</EindBestemming> <TreinSoort>Intercity</TreinSoort> <RouteTekst>A'dam Zuid, Hilversum, Amersfoort</RouteTekst> <Vervoerder>NS</Vervoerder> <VertrekSpoor wijziging="false">3</VertrekSpoor> </VertrekkendeTrein> </ActueleVertrekTijden> I've currently got these settings in props.conf: [ns_api] CHARSET=AUTO LINE_BREAKER=>\s*(?=) REPORT-xmlext=xml-extr SHOULD_LINEMERGE=false TIME_FORMAT=%Y-%m-%dT%H:%M:%S TIME_PREFIX=\ disabled=false pulldown_type=true And these settings in transforms.conf: [xml-extr] REGEX = <([^>]+)>([^<]*)<\/\1> FORMAT = $1::$2 MV_ADD = true REPEAT_MATCH = true Setting should_linemerge to true already helps a bit, but is still not correctly extracting separate events. ... View more