A city SOC is hunting last hour's firewall denies for the tax portal. Which initial filter follows Splunk efficient-search practice?
Select an answer to reveal the explanation.
Short Explanation
index=* is a city-wide paging storm — every indexer picks up the phone. Name the neighborhood first: index=net sourcetype=pan:traffic, then hunt the tax-portal denies.
Full Explanation
Efficient searches filter index and sourcetype as early as possible so indexers do not scan unrelated civic data. A firewall-deny hunt should start with a specific pair such as index=net sourcetype=pan:traffic rather than index=*. Deferring that filter until after transaction, or replacing it with makeresults, either explodes cost or reads no firewall logs at all. Tight time plus index/sourcetype is the default opening for production SOC searches.