Macros, Saved Searches and CIM →hardMultiple ChoiceObjective-mapped

SPLK-1002 max_time Practice Question

Exhibit

Refer to the exhibit.

An admin has created a CIM data model for web traffic with the following acceleration configuration:

```
{
  "acceleration": {
    "enabled": true,
    "max_time": "1d",
    "earliest_time": "-7d",
    "summaries": [
      {"period": "5m", "search": "..."},
      {"period": "1h", "search": "..."}
    ]
  }
}
```

The admin notices that a search using `| tstats` against this data model only returns results for the past 24 hours, not the full 7 days expected.

What is the most likely reason for this behavior?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The 'max_time' setting limits the accelerated data to the last 1 day, so tstats only queries that time range.

The 'max_time' setting in the acceleration configuration limits the accelerated data to the last 1 day. When using tstats, it only queries this accelerated time range, ignoring the 'earliest_time' of -7d in the search. Therefore, even though the search spans 7 days, tstats returns results only from the last 24 hours because the acceleration does not cover the older data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The 'max_time' setting limits the accelerated data to the last 1 day, so tstats only queries that time range.
Why this is correct
max_time defines how far back the acceleration data goes, not the final search.
✗
The acceleration summaries are only generated at the 5-minute and 1-hour intervals, not daily.
Why it's wrong here
Summaries are generated at those intervals, but the max_time limits the data range they cover.
✗
The acceleration is disabled because 'enabled' is set to true incorrectly.
Why it's wrong here
It is enabled, not disabled.
✗
The acceleration automatically becomes outdated after 1 day and requires a rebuild.
Why it's wrong here
Acceleration continuously updates; it does not become outdated permanently.

Go deeper

SPLK-1002 max_time Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question