<form theme="dark">
  <label>Cyber Fusion Center - Acceleration</label>
  <description>CIS Analytics | Corporate Information Security</description>
  <fieldset submitButton="true" autoRun="true">
    <input type="time" token="mytime">
      <label>Select a Time Range</label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Data Acceleration</title>
      <table>
        <search>
          <query>| rest splunk_server=local /services/server/introspection/kvstore/collectionstats
| mvexpand data
| spath input=data
| rex field=ns "(?&lt;App&gt;.*)\.(?&lt;Collection&gt;.*)"
| eval dbsize=round(size/1024/1024, 2)
| eval indexsize=round(totalIndexSize/1024/1024, 2)
| stats first(count) AS "Number of Objects" first(nindexes) AS Accelerations first(indexsize) AS "Acceleration Size (MB)" first(dbsize) AS "Collection Size (MB)" by App, Collection</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <format type="number" field="retention">
          <option name="precision">0</option>
          <option name="unit">Days</option>
        </format>
        <drilldown>
          <link target="_self">/app/cisa_sh_moswos/investigate_sourcetype?form.myindex=$row.Index$&amp;form.mysourcetype=$row.sourcetype$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>