A huge county index would be too expensive if tstats fell back to raw events. The analyst only wants summary data. What should they set?
Select an answer to reveal the explanation.
Short Explanation
On a county-sized index, falling back to raw is lighting money on fire. summariesonly=true keeps tstats on the summary lane only. If the summary is empty, the search stays cheap and honest.
Full Explanation
In Splunk Enterprise Security for a municipal SOC, tstats may fall back to raw events when accelerated summaries are incomplete, which on a huge county index can be prohibitively expensive during an investigation. Setting summariesonly=true (or the equivalent summary-only behavior) forces the search to stay on accelerated summaries so the analyst gets summary-backed answers without paying for a raw scan of civic telemetry. Running tstats with index=* so raw and summary are always merged fails by concept because that pattern invites the costly fallback and abandons summary discipline. Using transaction with no time bound so Splunk never touches summaries fails by concept because unbounded transaction is a different, heavier mechanism and does not enforce summary-only tstats behavior. Using makeresults to synthesize Authentication rows and skip the model fails by concept because invented rows are not authentic civic Authentication evidence. Exam caveat: SPLK-5001 expects analysts to use summariesonly when they must constrain tstats to accelerated summaries on large municipal indexes. Operational check: run the Authentication tstats both with and without summariesonly in a controlled test window, compare runtime and result completeness, keep summariesonly for production hunts when raw fallback is unacceptable, and escalate acceleration gaps if summary-only results are empty for sourcetypes that should already be mapped.