Other Usage

How to use time picker when using accelerated reports as base search in dashboard?

thisissplunk
Builder

I created an accelerated search that is set for 7 days retention, runs every 30 minutes and searches 30 minutes back when it runs. I set it up in my dashboard to be used as a base search like so:

 

  <search id="reportBase" ref="Accelerated report base">
          <earliest>$set_time.earliest$</earliest>
          <latest>$set_time.latest$</latest>
  </search>

 

I then attempt to use it and modify the results with tokens like so:

 

        <search base="reportBase">
          <query>| search type IN ($types$) AND account IN ($accounts$) | stats count by hostname | sort -count </query>

 

The new search modifications with tokens works. However, no matter what I do, the time picker does not work. I only ever get back the last 30 minutes of data. I thought the 7 day retention meant I could get back any amount of time up to 7 days back quickly, not just the last 30 minutes.

I tried to work around this by running this but the same thing happens:

 

| loadjob savedsearch="MyUser:search:Accelerated report base"

 

Then, I tried to use it in normal search and the time picker there also does nothing. It still only shows the last 30 minutes of data.

 

Am I missing something or can I not use accelerated reporting with a time picker?

Labels (1)
0 Karma

thisissplunk
Builder

I may be fundamentally misunderstanding how accelerated searching works. I thought I'd need to access the report or its results somehow.

What I see in my searches that use the exact same stats command is that the Job setting says "Using summaries for search"

This was not explained in any of the accelerated report documentation.

0 Karma
Get Updates on the Splunk Community!

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...