A 911/PSAP CAD outage started in the last hour. An analyst's first investigation search uses All Time on the CAD index. What is the most important efficient-search fix?
Select an answer to reveal the explanation.
Short Explanation
If the outage started in the last hour, do not rummage through years of 911 CAD. Pin the time window first — last 60 minutes — and the rest of the hunt gets cheaper and clearer.
Full Explanation
Splunk efficient-search practice starts by bounding time. A 911 CAD investigation whose trigger is the last hour should not run All Time; a tight earliest/latest (or last 60 minutes) limits index reads before other filters apply. Leading wildcards, verbose mode, and index=* all increase cost and work against that first constraint. Time-bounding is especially important on shared civic search heads that also run live monitoring.