A summary index is populated by two scheduled searches: one that summarizes data for the last 24 hours and another that summarizes data for the last 7 days. Both searches write to the same summary index. When a user runs a search against the summary index for the last 7 days, they notice that counts are double what they expect. What is the most likely cause?

The summary index contains raw events instead of summarized data.

The two searches are writing overlapping data for the same time periods.

The summary index has a data retention policy that duplicates events.

The user's search is using the wrong time range.

An administrator notices that several reports have acceleration enabled, but one report's summary is not being built. They want to see the status of all accelerated reports in one place. Where should they look?

The Report Acceleration Summaries page under Settings.

The Data Models page under Settings.

The Summary Detail page for each individual report.

An analyst wants to accelerate a saved report that uses the search: index=web sourcetype=access_combined | top 10 uri_path. The report is scheduled to run every hour over the last 24 hours. Will Splunk build an acceleration summary for this report?

Yes, but only if the report is scheduled to run every 5 minutes.

No, because the top command is not supported for report acceleration.

No, because the time range is too short for acceleration to be useful.

Yes, because the report uses the transforming command top and has a fixed time range.

What is the benefit of searching a summary index instead of raw data?

It is faster because the results are already pre-computed

It uses less disk space than raw data

It returns more detailed raw events

SplunkCore Certified Advanced Power User

Domain 4Objective 1

Understanding Acceleration core-certified-advanced-power-user Practice Questions (Page 3)

Part of the Acceleration and Search Performance domain, which makes up ~18% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–7 in this domain), expect 1–2 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

11concepts

Questions 11–15

11foundation · easy
Which of the following commands can be used in a summary indexing search to produce summary data?
Select an answer first
12application · medium
A summary index is populated by two scheduled searches: one that summarizes data for the last 24 hours and another that summarizes data for the last 7 days. Both searches write to the same summary index. When a user runs a search against the summary index for the last 7 days, they notice that counts are double what they expect. What is the most likely cause?
Select an answer first
13application · medium
An administrator notices that several reports have acceleration enabled, but one report's summary is not being built. They want to see the status of all accelerated reports in one place. Where should they look?
Select an answer first
14application · medium
An analyst wants to accelerate a saved report that uses the search: index=web sourcetype=access_combined | top 10 uri_path. The report is scheduled to run every hour over the last 24 hours. Will Splunk build an acceleration summary for this report?
Select an answer first
15foundation · easy
What is the benefit of searching a summary index instead of raw data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to core-certified-advanced-power-user

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “core-certified-advanced-power-user” is a trademark of its owner, used for identification only.

Understanding Acceleration core-certified-advanced-power-user Practice Questions (Page 3)

Questions 11–15

Which of the following commands can be used in a summary indexing search to produce summary data?

An administrator notices that several reports have acceleration enabled, but one report's summary is not being built. They want to see the status of all accelerated reports in one place. Where should they look?

An analyst wants to accelerate a saved report that uses the search: index=web sourcetype=access_combined | top 10 uri_path. The report is scheduled to run every hour over the last 24 hours. Will Splunk build an acceleration summary for this report?

What is the benefit of searching a summary index instead of raw data?

Keep studying — Acceleration and Search Performance