I know that 'Zoom out' will make the search to re-execute but I am not sure about 'zoom in' or 'zoom to select'. Kindly let me know if it does?
@palisetty best answer is you should try it out by yourself to learn. Do you have Splunk instance? How did you check "Zoom Out" runs a new search?
Have you read the Splunk Documentation and tried each of the Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Usethetimeline#Zoom_in_and_zoom_out_to_in...
PS: All the points you have asked has been specifically taught in the Fundamentals 1 course. If nothing works out for you it is time for you to revise the course. These are very basic concepts and understanding them is better approach than preparing a question bank or mugging up crucial concepts just for the sake of clearing the certification exam. If you feel you are under-prepared you can also re-schedule your exam to a later date.
@palisetty best answer is you should try it out by yourself to learn. Do you have Splunk instance? How did you check "Zoom Out" runs a new search?
Have you read the Splunk Documentation and tried each of the Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Usethetimeline#Zoom_in_and_zoom_out_to_in...
PS: All the points you have asked has been specifically taught in the Fundamentals 1 course. If nothing works out for you it is time for you to revise the course. These are very basic concepts and understanding them is better approach than preparing a question bank or mugging up crucial concepts just for the sake of clearing the certification exam. If you feel you are under-prepared you can also re-schedule your exam to a later date.
@niketn
In Fundamentals 1 elearning Module 5, the instructor mentions "Selecting or zooming into events uses your original search job. When you zoom out, Splunk runs a new search job."
In the Fundamentals 1 pdf however, it mentions on page 68 that both Zoom Out and Zoom to selection re-executes the search.
Seems like a discrepancy between the instructor video and the slides in the pdf.
I noticed the discrepancy between the instructor video and the slides in the pdf, as well, indigeek.
I see that it is happening
Cool now you will not forget the concept. Only when you mouse over and select bars in the timeline or choose Deselect then a new search will not execute. Rest all scenarios new search is run. Which you can very easily try and learn.
If your issue is resolved please go ahead and accept the answer 🙂
'zoom to select' will allow you to show only selected events for particular interval you applied 'zoom to select'. likewise 'Zoom-out' search will also re-execute as per applied selection.
I know that. My question is, will 'zoom in' will go for re-execution of a search or no after selecting a particular set of time ranges from the timeline.
Yes, you can check this in "Inspect Job" for related execution costs.