The parking-meter ID extraction will be needed every night, not just this incident. When should the analyst stay with search-time rex versus a durable extraction?
Select an answer to reveal the explanation.
Short Explanation
A highlighter is fine for one messy page. If that parking-meter log is tonight's homework every night, print the field into the TA instead. rex for the incident; a durable extraction for the routine.
Full Explanation
Search-time rex is appropriate for one-off incident response when a field is not yet extracted. If a civic sourcetype will be queried on a schedule, a persistent field extraction or technical add-on is the durable path and supports CIM. Leaving nightly hunts on ad-hoc rex is fragile. makeresults does not extract production fields.