Zoom to selection

[palisetty]

I know that 'Zoom out' will make the search to re-execute but I am not sure about 'zoom in' or 'zoom to select'. Kindly let me know if it does?

[niketn · Accepted solution]

@palisetty best answer is you should try it out by yourself to learn. Do you have Splunk instance? How did you check "Zoom Out" runs a new search?

Have you read the Splunk Documentation and tried each of the Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Usethetimeline#Zoom_in_and_zoom_out_to_in...

PS: All the points you have asked has been specifically taught in the Fundamentals 1 course. If nothing works out for you it is time for you to revise the course. These are very basic concepts and understanding them is better approach than preparing a question bank or mugging up crucial concepts just for the sake of clearing the certification exam. If you feel you are under-prepared you can also re-schedule your exam to a later date.

[indigeek]

@niketn 

In Fundamentals 1 elearning Module 5, the instructor mentions "Selecting or zooming into events uses your original search job. When you zoom out, Splunk runs a new search job."
In the Fundamentals 1 pdf however, it mentions on page 68 that both Zoom Out and Zoom to selection re-executes the search.
Seems like a discrepancy between the instructor video and the slides in the pdf.

[ca_red891]

I noticed the discrepancy between the instructor video and the slides in the pdf, as well, indigeek.

[palisetty]

I see that it is happening

[niketn]

Cool now you will not forget the concept. Only when you mouse over and select bars in the timeline or choose Deselect then a new search will not execute. Rest all scenarios new search is run. Which you can very easily try and learn.

[niketn]

If your issue is resolved please go ahead and accept the answer 🙂

[rkyadav]

'zoom to select' will allow you to show only selected events for particular interval you applied 'zoom to select'. likewise 'Zoom-out' search will also re-execute as per applied selection.

[palisetty]

I know that. My question is, will 'zoom in' will go for re-execution of a search or no after selecting a particular set of time ranges from the timeline.

[rkyadav]

Yes, you can check this in "Inspect Job" for related execution costs.