The parking-meter ID extraction will be needed every night, not just this incident. When should the analyst stay with search-time rex versus a durable extraction?
Select an answer to reveal the explanation.
Short Explanation
A highlighter is fine for one messy page. If that parking-meter log is tonight's homework every night, print the field into the TA instead. rex for the incident; a durable extraction for the routine.
Full Explanation
In Splunk Enterprise Security for a municipal SOC, search-time rex is appropriate for one-off incident response when a field is not yet extracted, but recurring nightly use of a civic sourcetype deserves a persistent field extraction or technical add-on that supports CIM. For parking-meter ID extraction needed every night—not just this incident—the durable path is a props/transforms extraction or TA, while ad-hoc rex remains the right tool for the immediate investigation. Keeping ad-hoc rex forever so the CIM model never has to change fails by concept because fragile hunt SPL is not a substitute for maintainable extractions on scheduled civic telemetry. Using rex only in dashboard XML and never in an investigation search fails by concept because investigations need the field in search; dashboards alone do not fix the sourcetype. Replacing both with makeresults rows that hard-code last night’s meter IDs fails by concept because hard-coded synthetic IDs are not extraction and will not track new meters. Exam caveat: SPLK-5001 distinguishes ad-hoc search-time rex for IR from persistent extractions/TAs for routine municipal sourcetypes. Operational check: finish the incident with search-time rex, open a content request for a persistent parking-meter field extraction or TA mapped toward CIM where appropriate, validate the extraction in a non-prod search head, and retire the temporary rex from nightly hunts once the durable field exists.