The mayor's office dashboard of 911 SIP error counts refreshes every five minutes and currently runs a raw index search on each refresh. What should the city SOC recommend?
Select an answer to reveal the explanation.
Short Explanation
A dashboard that pokes the raw 911 index every five minutes is like rerunning a census to answer one question. Pre-summarize: summary index or an accelerated data model, then the mayor's panel just reads the rollup. Faster refresh or all-time raw search only hammers the search head harder.
Full Explanation
Dashboards that refresh every five minutes should not re-run expensive raw index searches on each poll when the mayor's office only needs 911 SIP error counts. Backing the panel with a summary index or an accelerated data model lets each refresh read pre-aggregated civic rollups instead of recounting raw SIP events. Shortening refresh to every 15 seconds multiplies load without fixing the raw-search design. Mailing an Excel export each morning abandons near-real-time situational awareness the dashboard exists to provide. Removing the time bound so every refresh scans all 911 history makes five-minute polling even more hostile to the shared search head. Exam caveat: summary design must still honor retention and late-arriving events; acceleration health matters as much as the dashboard XML. Operational check: point the mayor's SIP error panel at a summary index or accelerated model, verify five-minute refreshes stay light in monitoring consoles, and keep the raw search only for drilldown investigations. Document the revised approach in the civic SOC runbook so the next on-call analyst inherits the correct pattern rather than the anti-pattern. Retain Job Inspector evidence with the change ticket for municipal audit readiness.