@mortf I'm also experiencing this issue, the following error message is flooding my splunkd.log: WARN SearchResultsFiles - Unable to parse site_label, label=invalid due to err="Invalid site id: invalid"   Can you confirm upgrading to a later version of Splunk resolved your issue? If so, what version did you upgrade to?   ... View more

Never, stop asking. ... View more

@ips_mandar what version of Splunk are you using?   Report Acceleration has been problem in Splunk for awhile, as nobody seems to use the feature – see https://community.splunk.com/t5/Reporting/Splunk-8-0-2-report-acceleration-broken-for-reports-using/m-p/472290 for more details. ... View more

When is this issue getting fixed? ... View more

Issue not fixed in Splunk Enterprise 8.1.0 ... View more

When is this getting fixed? ... View more

@nvanderwalt_spl can we get a SPL ticket assigned for this? Staring at "Finalizing job..." all day long isn't working out as a solution. The updates to limits.conf below to alleviate the search performance degradation caused by the workaround "phased_execution_mode = singlethreaded" still result in "Finalizing job..." in the GUI.   limits.conf [search] phased_execution_mode = singlethreaded result_queue_max_size = 400000000 max_chunk_queue_size = 10000000 remote_timeline_fetchall = 0 fetch_remote_search_log = disabled ... View more

Neither is a solution (smiley face emoji) so I'll just keep bumping the issue periodically to attract attention. The reason we migrated to embedded subsearches was to stop hardcoding variables into a report. Definitely not rolling that back. ... View more

Using the workaround of  # add to limits.conf [search] phasedexecutionmode = singlethreaded   Leads to searches stuck at "Finalizing job... " in the GUI.    After consulting old posts, I tried another workaround of  # add to limits.conf [search] remote_timeline_fetchall = 0   However this had no impact. Are there any other workarounds I can try?   ... View more

When can we expect one to be assigned? The workaround is a not a solution due to the report generation performance impact. ... View more

@gjanders Has this been assigned an SPL issue number yet? ... View more

I'm glad to hear you were able to reproduce the issue. The previously mentioned workaround is acceptable as a short-term solution – how it's causing other search-related performance issues, so a long-term  fix would be greatly appreciated. ... View more

Outside of the previously described workaround, my *.conf files are in the default state. The csv in my example is just a list of specific identifiers (simple integers) that are referenced in the inputlookup function in the search below: index="myindex" [| inputlookup input.csv | fields id | rename id as ID | format] | fields NAME ID | stats count(RECORD) as "Record" by NAME _time | dedup NAME sortby _time | rename NAME as "Username" | where _time>=relative_time(now(), "-2d@h") AND _time<=relative_time(now(), "@h") | eval mytime=strftime(_time,"%Y-%m-%dT%H:%M:%SZ") | table "Record" mytime | outputcsv export.csv   ... View more

The previously described workaround of adding phased_execution_mode = singlethreaded to the [search] stanza in limits.conf helps alleviate the issue, but leads to other performance issues – such as jobs stuck at "Finalizing..." in the GUI. ... View more

I updated our Splunk instance to 8.0.4.1 from 8.01 today and this issue is not resolved. The patch notes (https://docs.splunk.com/Documentation/Splunk/8.0.4/ReleaseNotes/Fixedissues#Splunk_Enterprise_8.0.4.1) indicate  SPL-184327 was supposed to be fixed in 8.0.4.   As noted in the original issue,  report acceleration is not working correctly for reports using inputlookup command (example: csv input) in subsearches. Due to this, report generation (of the affected reports) is exponentially longer.   Any chance this issue can be reviewed for a future Splunk update? ... View more

Sure, done. ... View more

Fantastic news, thanks! ... View more

Fantastic, thanks for submitting the case! ... View more

Thanks, I'll update OP to indicate subsearch requirement. ... View more

Try doing the inputlookup as a subsearch. In my case, it looks like this: [| inputlookup file.csv | fields title | rename title as TITLE | format] ... View more

Yes, the summary was 100% complete as shown in OP screenshot. Prior to the 8.0.2 upgrade the report acceleration was working as intended. ... View more

Schedule the second search you created to run at some interval and see if the "Access Count" number increases after each scheduled report runs. In my case, the count doesn't go up and the report generates slowly – despite showing that it is using the acceleration (summary) index on the Report Acceleration Summaries page. ... View more

Thanks! It can be found at https://:8000/en-US/manager/system/summarization ... View more

Were you able to report a support case? Has anyone else reported this issue? ... View more

Downgrading to 8.0.1 resulted in acceleration working correctly again. Do you know if there's a full list of changes in 8.0.2 that we can review for a possible cause? ... View more