topic Re: Zoom to selection in Splunk Search

Zoom to selection

palisetty — Fri, 03 Jan 2020 10:53:24 GMT

I know that 'Zoom out' will make the search to re-execute but I am not sure about 'zoom in' or 'zoom to select'. Kindly let me know if it does?

Re: Zoom to selection

rkyadav — Fri, 03 Jan 2020 12:55:11 GMT

'zoom to select' will allow you to show only selected events for particular interval you applied 'zoom to select'. likewise 'Zoom-out' search will also re-execute as per applied selection.

Re: Zoom to selection

palisetty — Fri, 03 Jan 2020 12:59:46 GMT

I know that. My question is, will 'zoom in' will go for re-execution of a search or no after selecting a particular set of time ranges from the timeline.

Re: Zoom to selection

rkyadav — Fri, 03 Jan 2020 13:03:49 GMT

Yes, you can check this in "Inspect Job" for related execution costs.

Re: Zoom to selection

niketn — Fri, 03 Jan 2020 13:30:05 GMT

@palisetty best answer is you should try it out by yourself to learn. Do you have Splunk instance? How did you check "Zoom Out" runs a new search?

Have you read the Splunk Documentation and tried each of the Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Usethetimeline#Zoom_in_and_zoom_out_to_investigate_events

PS: All the points you have asked has been specifically taught in the Fundamentals 1 course. If nothing works out for you it is time for you to revise the course. These are very basic concepts and understanding them is better approach than preparing a question bank or mugging up crucial concepts just for the sake of clearing the certification exam. If you feel you are under-prepared you can also re-schedule your exam to a later date.

Re: Zoom to selection

palisetty — Fri, 03 Jan 2020 13:45:57 GMT

I see that it is happening

Re: Zoom to selection

niketn — Fri, 03 Jan 2020 15:34:28 GMT

Cool now you will not forget the concept. Only when you mouse over and select bars in the timeline or choose Deselect then a new search will not execute. Rest all scenarios new search is run. Which you can very easily try and learn.

Re: Zoom to selection

niketn — Mon, 06 Jan 2020 18:59:15 GMT

If your issue is resolved please go ahead and accept the answer 🙂

Re: Zoom to selection

indigeek — Fri, 16 Apr 2021 06:50:45 GMT

@niketn

In Fundamentals 1 elearning Module 5, the instructor mentions "Selecting or zooming into events uses your original search job. When you zoom out, Splunk runs a new search job."
In the Fundamentals 1 pdf however, it mentions on page 68 that both Zoom Out and Zoom to selection re-executes the search.
Seems like a discrepancy between the instructor video and the slides in the pdf.

Re: Zoom to selection

ca_red891 — Thu, 14 Oct 2021 18:40:29 GMT

I noticed the discrepancy between the instructor video and the slides in the pdf, as well, indigeek.