In order to successfully accelerate a report, which criteria must the search meet? (Select all that apply.)

Report acceleration works by creating a summary of the data generated by a search up to its first transforming command. For this process to be successful, several criteria must be met. The search must contain a transforming command (e.g., stats, chart, timechart) to define the statistical summary that will be accelerated. All commands preceding this transforming command must be streamable, meaning they can operate on events one by one. Non-streaming commands would require the entire dataset, defeating the purpose of the summary. Finally, event sampling is incompatible with report acceleration because sampling uses a subset of data, while acceleration builds a complete summary of all relevant data.

C. Use a standard Splunk visualization.

The type of visualization used to display report results is independent of the backend search acceleration process and does not affect whether a report can be accelerated.

1. Splunk Enterprise Documentation

Knowledge Manager Manual

"Manage report acceleration": This section explicitly lists the requirements for a search to be eligible for report acceleration.

"The search must include a transforming command such as stats

chart

timechart

top

rare

or sistats." (Supports option B)

"The commands in the search string that come before the first transforming command must be streamable." (Supports option D)

"The search cannot use event sampling." (Supports option A)

2. Splunk Enterprise Documentation

Search Manual

"Types of commands": This document defines and distinguishes between streaming and transforming commands

which is foundational to understanding the requirements for report acceleration.

"About transforming commands": Explains that these commands "transform the specified cell values for each event into numerical values that Splunk software can use for statistical purposes." This is the core function that report acceleration leverages.

"Streaming commands": Defines streaming commands as those that "run on each event as it is returned by a search." This is a prerequisite for the pre-transforming part of an accelerated search.