splunk · SPLK-1004 · Q604 · multiple_choice · topic_1

What qualifies a report for acceleration?

A.Fewer than 100k events in search results, with transforming commands used in the search string.
B.More than 100k events in search results, with only a search command in the search string.
C.More than 100k events in the search results, with a search and transforming command used in the search string.
D.Fewer than 100k events in search results, with only a search and transaction command used in the search string.

Explanation

Selected Answer: C  search must include a transforming command (stats, timechart, top)  only distributable streaming commands before the transforming command (or none).  More than 100k events in the summary range

Reference: examtopics_top_comment

Practice with progress tracking

Start tracked practice Pricing