Transit bus-CAD events already have a CIM src field from the add-on. An analyst still runs rex on millions of hot events to extract the same source address. What is the efficient practice?
Select an answer to reveal the explanation.
Short Explanation
If the transit add-on already stamped CIM src, do not regex the same address out of millions of hot events. Reuse the mapped field — rex is for buried one-offs, not for re-extracting what the TA already gave you.
Full Explanation
Per-search rex on high-volume hot data is expensive. When a technical add-on already maps a CIM field such as src on transit bus-CAD events, efficient practice is to reuse that extraction. Re-running regex, rebuilding src with makeresults, or applying a leading-wildcard rex adds cost without new analytic value. Reserve search-time rex for fields that are not already extracted.