Transit bus-CAD events already have a CIM src field from the add-on. An analyst still runs rex on millions of hot events to extract the same source address. What is the efficient practice?
Select an answer to reveal the explanation.
Short Explanation
If the transit add-on already stamped CIM src, do not regex the same address out of millions of hot events. Reuse the mapped field — rex is for buried one-offs, not for re-extracting what the TA already gave you.
Full Explanation
When a transit add-on already maps CIM src on bus-CAD events, efficient practice is to reuse that TA-mapped field instead of running rex on millions of hot events to extract the same source address again. Per-search regex re-extraction burns CPU on hot buckets and duplicates work the technical add-on already performed at search time or index time. Always rexing _raw so add-on mappings are ignored is the anti-pattern the exam wants candidates to reject. Dropping the CIM field and rebuilding src with makeresults invents values instead of using live CAD telemetry. A leading-wildcard rex is both unnecessary and hostile to index efficiency. Exam caveat: rex remains correct when a one-off field is truly buried in _raw and not provided by the TA—do not confuse that exception with re-extracting standardized CIM src. Operational check: table src from a sample of bus-CAD events without rex, confirm the TA mapping is populated, remove redundant rex from the hunt, and note the CPU drop in Job Inspector on the hot time range. Document the revised SPL in the civic SOC runbook so the next on-call analyst inherits the efficient pattern rather than the anti-pattern. Retain Job Inspector screenshots with the change ticket for audit.