The mayor's office dashboard of 911 SIP error counts refreshes every five minutes and currently runs a raw index search on each refresh. What should the city SOC recommend?
Select an answer to reveal the explanation.
Short Explanation
A dashboard that pokes the raw 911 index every five minutes is like rerunning a census to answer one question. Pre-summarize: summary index or an accelerated data model, then the mayor's panel just reads the rollup. Faster refresh or all-time raw search only hammers the search head harder.
Full Explanation
Frequently refreshed security views should not re-execute an expensive raw search on each interval. Splunk efficient-search practice is to back those panels with a summary index or data-model acceleration so each refresh reads pre-computed civic SIP-error counts. Shortening the refresh or dropping the time bound multiplies indexer load. A daily Excel mailer is not a five-minute operational view and is not the SPL pattern this objective tests.