In order to successfully accelerate a report, which criteria must the search meet? (Select all that apply.)
In order to successfully accelerate a report, which criteria must the search meet? (Select all that apply.)
To successfully accelerate a report in Splunk, the search must meet three criteria: it cannot use event sampling, it must use a transforming command, and if there are commands before the first transforming command, they must be streamable.
Im not sure how to respond to that
For a report to qualify for acceleration its search must meet three criteria: The search string must use a transforming command (such as chart, timechart, stats, and top). If the search string has any commands before the first transforming command, they must be streamable. The search cannot use event sampling.