Just had a look in datamodels.conf - I think this setting refers to: acceleration.poll_buckets_until_maxtime = <bool> When set to "true": All of the machines run for "max_time" (approximately). ... View more

I've got a customer who is experiencing this same issue. As soon as I turn off the "Accelerate until maximum time" setting, the run times drop back to normal levels. They're on SplunkCloud 7.0.9.1 if that helps. Will raise with Splunk support as well. ... View more

Realise this is a bit late, but came across the same problem and found the below to work as well - might be a bit faster as it's just using one eval? | eval MAC=replace(MAC, "(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})", "\1:\2:\3:\4:\5:\6") ... View more