If the network telemetry is already ingested and correctly mapped to CIM, the remaining configuration relevant to this dashboard is acceleration of the Network Traffic data model . Enterprise Security dashboards and searches can depend on accelerated data models so that large volumes of normalized security telemetry can be queried efficiently.

Data-model acceleration creates summarized structures that commands such as tstats can search much more efficiently than repeatedly scanning underlying raw events. Consequently, a dashboard built against an accelerated CIM data model may fail to provide the expected results when acceleration is disabled, incomplete, or otherwise unavailable even though raw CIM-compliant events exist.

The question specifically concerns traffic over time by action , making the Network Traffic data model the relevant CIM domain. The Performance data model is unrelated, and Network Sessions is not the applicable model identified by the requested network-traffic visualization.

Troubleshooting should therefore follow the data pipeline logically: confirm ingestion, validate sourcetypes and field normalization, validate tags and CIM membership, then verify the required data-model acceleration and summary coverage.

Study Guide topics: Network Traffic data model, CIM, data-model acceleration, tstats, Enterprise Security dashboards, troubleshooting.