After filtering assessor-office authentication events, later commands only need src, user, and action. How should the analyst reduce search cost?
Select an answer to reveal the explanation.
Short Explanation
Do not haul the whole filing cabinet to the next desk when the hunt only needs three folders. fields — or table — keeps src, user, and action and leaves the extra CIM clutter behind.
Full Explanation
After assessor-office authentication events are filtered, later pipeline stages should carry only the fields the hunt needs—commonly CIM src, user, and action—using fields or table so subsequent commands shuffle less data. Dropping unused extracted fields reduces memory and network cost between search peers and the search head without changing the analytical answer. Keeping every extracted field just in case forces transaction and other heavy commands to move unnecessary columns through the rest of the pipeline. Exporting unfiltered events to CSV and deleting columns in a spreadsheet moves work out of Splunk and retains the expensive search underneath. Verbose mode adds more fields and increases cost, which is the opposite of the goal after filtering. Exam caveat: prune fields after you still need them for joins or lookups; stripping a join key too early breaks enrichment on civic identity and asset tables. Operational check: insert fields src, user, action or an equivalent table command before the transforming stages on the assessor hunt, compare transferred volumes in the job inspector to the unpruned version, and keep the lean field set in the saved search. Document the revised SPL in the civic SOC runbook so the next on-call analyst inherits the efficient pattern rather than the anti-pattern.