A municipal hunt is streaming every clerk-PC endpoint event into the search UI before anyone counts users. What efficient-search change should come first?
Select an answer to reveal the explanation.
Short Explanation
If the question is 'how many users,' do not FedEx every clerk-PC event to the browser. Drop in stats or tstats as soon as the hunt allows so only the counts travel.
Full Explanation
Transforming commands such as stats and tstats collapse events into aggregations. Placing them as early as the investigation allows prevents the search head from streaming every clerk-PC endpoint event to the UI. Removing the time bound, switching to verbose mode, or wrapping a week of events in transaction all increase volume. Return raw events only when the analyst truly needs the individual lines.