A city SOC is hunting last hour's firewall denies for the tax portal. Which initial filter follows Splunk efficient-search practice?
Select an answer to reveal the explanation.
Short Explanation
index=* is a city-wide paging storm — every indexer picks up the phone. Name the neighborhood first: index=net sourcetype=pan:traffic, then hunt the tax-portal denies.
Full Explanation
Efficient searches filter index and sourcetype as early as possible so indexers do not scan unrelated municipal data. A city SOC hunt for last hour's tax-portal firewall denies should open with a specific pair such as index=net sourcetype=pan:traffic plus a tight time range, not index=. Early partition filters are the default opening for production SOC searches on shared civic infrastructure. Starting with index= forces every municipal index to participate and defers selectivity to a dashboard after the damage is done. Omitting index and sourcetype until after a transaction of all events explodes cost and memory use. Leading with makeresults reads no firewall logs at all and cannot hunt denies on the tax portal. Exam caveat: correct index/sourcetype names come from the onboarding map—guessing pan:traffic when the TA uses a different sourcetype yields empty results that look like no denies. Operational check: confirm the tax-portal firewall sourcetype from the data inventory, run the deny hunt with that index/sourcetype and last 60 minutes, and reject any saved search that still begins with index=* for this use case. Document the revised SPL in the civic SOC runbook so the next on-call analyst inherits the efficient pattern rather than the anti-pattern.