A sheriff's-office analyst searches high-volume authentication logs with *admin to find privileged civic accounts. Why is that pattern a problem?
Select an answer to reveal the explanation.
Short Explanation
A leading asterisk is like asking the records clerk to read every badge in the jail to see if it ends in admin. The index cannot jump to a term that starts with a wildcard, so high-volume auth logs get scanned the hard way.
Full Explanation
Leading wildcards disable efficient use of the index because Splunk cannot seek a term whose beginning is unknown. On high-volume sheriff authentication logs, *admin becomes a scan rather than a term lookup. Trailing wildcards and exact user values are cheaper when the prefix is known. Wildcards are not ignored, and CIM Authentication searches do not require a leading-wildcard privileged-account pattern.