Hello everyone,
we are using Splunk 7.2.9 and at the moment im trying to figure out why the datamodel command leads to different results when we use the search mode "search" than when we use "accelerate_search". So i looked at the search strings of both versions and fiddled around with them a bit. I came to the conclusion that the "read_summary" directive used in the "search"-version seams to be causing the differences. So I started searching for an explanation what this directive is actually doing but only found the short paragraph in the limits.conf documentation which doesn't really help.
So in short: can anybody explain to me what this directive is exactly doing or provide me a link to such an explanation that i maybe just didn't find?
Thanks in advance.
