Hi ifedak_splunk Please find answer in the link below. May be this will help you. https://answers.splunk.com/answers/549997/failed-to-find-event-log.html ... View more

Acceleration has restrictions, check this out.... https://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Aboutdatamodels To accelerate a data model, it must contain at least one root event dataset, or one root search dataset that only uses streaming commands. Acceleration only affects these dataset types and datasets that are children of those root datasets. You cannot accelerate root search datasets that use nonstreaming commands (including transforming commands), root transaction datasets, and children of those datasets. Data models can contain a mixture of accelerated and unaccelerated datasets. ... View more