Which two sections can be expanded using the Search Job Inspector?

Question

Options

• AExecution costs.
• BSaved search history.
• CSearch job properties.
• DOptimization suggestions.

Explanation

Execution Costs (A) and Search Job Properties (C) are the two expandable sections in Splunk's Search Job Inspector.

The Search Job Inspector is a Splunk diagnostic tool that helps you analyze and troubleshoot search performance. Search job properties displays metadata about the search - such as the SID, scan count, event count, and run time - and can be expanded to reveal full detail. Execution costs breaks down where time was spent during the search (e.g., command-level processing costs) and is also expandable for a granular view.

Saved search history (B) is incorrect because that information lives in the Search History or Searches, Reports, and Alerts page - not in the Job Inspector. Optimization suggestions (D) is a distractor; while Splunk does offer some guidance via the Search Assistant and accelerations, there is no "Optimization suggestions" section inside the Job Inspector itself.

Memory tip: Think of the Job Inspector as answering two questions - "What was this job?" (Properties) and "What did it cost to run?" (Execution costs) - both expandable to dig deeper.

No community discussion yet for this question.