A city SOC analyst needs a running count of failed VPN logons per clerk identity for the last hour, but the draft search starts with index=* | streamstats count by user. What should the analyst change first?
Select an answer to reveal the explanation.
Short Explanation
streamstats is a lawn mower: useful on a small yard, brutal if you run it across the whole city park. Filter the VPN index, sourcetype, and hour first, then stream. eventstats on index=* is the same expensive mistake with a different name.
Full Explanation
streamstats and eventstats are streaming statistical commands that work event-by-event or across the current result set; they are appropriate after a tight filter, not as the first pipe on unfiltered index=*. Splunk efficient-search practice is to bound time, index, and sourcetype so expensive stream commands see only the civic VPN failed-logon rows. transaction and oversized subsearches add more cost without fixing the anti-pattern. The analyst keeps streamstats, but only after the dataset is already small.