"today" will always contain the last 5 minutes of data which is not accelerated, and that returns something.
If I run yesterday I get the standard:
This search has completed and found 371,510 matching events. However, the transforming commands in the highlighted portion of the following search:
| tstats values from datamodel=internal_server
over the time range:
02/11/2015 00:00:00.000 – 03/11/2015 00:00:00.000
generated no results. Possible solutions are to:
So there is data, but it seems like the accelerated DM just doesn't want to show fields not explicitly mentioned.
... View more