Splunk
SPLK-5001 · Question #108
Which argument would an analyst use to search only accelerated data contained in the Network Traffic Data Model with the tstats command?
The correct answer is C. summariesonly=true. Adding summariesonly=true to your tstats call ensures it queries only the accelerated (summarized) portions of the Network Traffic data model, maximizing performance.
Security Data Onboarding and Normalization
Question
Which argument would an analyst use to search only accelerated data contained in the Network Traffic Data Model with the tstats command?
Options
- Aaccelerated=true
- Bdatamodel=accelerated
- Csummariesonly=true
- Ddataset=accelerated
How the community answered
(39 responses)- A8% (3)
- B15% (6)
- C72% (28)
- D5% (2)
Explanation
Adding summariesonly=true to your tstats call ensures it queries only the accelerated (summarized) portions of the Network Traffic data model, maximizing performance.
Topics
#tstats#data model acceleration#summariesonly#Network Traffic Data Model
Community Discussion
No community discussion yet for this question.