Splunk

SPLK-3001 · Question #51

What does the summariesonly=true option do for a correlation search?

The correct answer is A. Searches only accelerated data. https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-do-correlation-searches-in- Enterprise-Security-not-use-quot/m-p/262622

Tuning Correlation Searches

Question

What does the summariesonly=true option do for a correlation search?

Options

ASearches only accelerated data.
BForwards summary indexes to the indexing tier.
CUses a default summary time range.
DSearches summary indexes only.

How the community answered

(19 responses)

A
79% (15)
B
11% (2)
C
5% (1)
D
5% (1)

Explanation

https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-do-correlation-searches-in- Enterprise-Security-not-use-quot/m-p/262622

Topics

#summariesonly#accelerated data#data models#correlation search

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion

Full SPLK-3001 Practice