I'm running a search that is something like this:
| tstats values from datamodel=foo
When the datamodel is not accelerated, I get all my data.
When it is accelerated, no data is returned.
If i specify the fields with `values(foo)`, `values(bar) `and so on, it works just fine.
Does anyone know if wildcards or returning all values at once isn't supposed to work if the datamodel is accelerated?
Any way to get around this?
Thanks!
↧