Other Usage

How to use time picker when using accelerated reports as base search in dashboard?

thisissplunk
Builder

I created an accelerated search that is set for 7 days retention, runs every 30 minutes and searches 30 minutes back when it runs. I set it up in my dashboard to be used as a base search like so:

 

  <search id="reportBase" ref="Accelerated report base">
          <earliest>$set_time.earliest$</earliest>
          <latest>$set_time.latest$</latest>
  </search>

 

I then attempt to use it and modify the results with tokens like so:

 

        <search base="reportBase">
          <query>| search type IN ($types$) AND account IN ($accounts$) | stats count by hostname | sort -count </query>

 

The new search modifications with tokens works. However, no matter what I do, the time picker does not work. I only ever get back the last 30 minutes of data. I thought the 7 day retention meant I could get back any amount of time up to 7 days back quickly, not just the last 30 minutes.

I tried to work around this by running this but the same thing happens:

 

| loadjob savedsearch="MyUser:search:Accelerated report base"

 

Then, I tried to use it in normal search and the time picker there also does nothing. It still only shows the last 30 minutes of data.

 

Am I missing something or can I not use accelerated reporting with a time picker?

Labels (1)
0 Karma

thisissplunk
Builder

I may be fundamentally misunderstanding how accelerated searching works. I thought I'd need to access the report or its results somehow.

What I see in my searches that use the exact same stats command is that the Job setting says "Using summaries for search"

This was not explained in any of the accelerated report documentation.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...