After filtering assessor-office authentication events, later commands only need src, user, and action. How should the analyst reduce search cost?
Select an answer to reveal the explanation.
Short Explanation
Do not haul the whole filing cabinet to the next desk when the hunt only needs three folders. fields — or table — keeps src, user, and action and leaves the extra CIM clutter behind.
Full Explanation
After index, sourcetype, and time filters, the fields (or table) command limits which attributes travel to later pipeline stages. For an assessor authentication hunt that only needs src, user, and action, dropping unused fields reduces memory and network cost. Verbose mode and keeping every extraction increase cost. Exporting raw events to a spreadsheet moves the aggregation out of Splunk and is not an efficient SOC pattern.