Transit SOC needs the top talkers on the bus-yard network for the last 15 minutes, and an intern starts exporting raw NetFlow events to Excel. What should the analyst do instead?
Select an answer to reveal the explanation.
Short Explanation
Do not dump the bus-yard firehose into a spreadsheet and hope PivotTables keep up. Keep the top-talker math in Splunk: tstats on the accelerated Network_Traffic model, then chart. Excel is for the slide, not for aggregating civic NetFlow.
Full Explanation
For a short-window top-talkers question, tstats against an accelerated CIM Network_Traffic data model plus chart (or stats) performs aggregation where the data already lives. Exporting raw NetFlow to Excel moves millions of events off-platform, loses acceleration, and is not a Splunk efficient-search pattern. transaction across index=* and turning acceleration off make the problem worse. The civic briefing still can be copied out after SPL has already reduced the result to top talkers.