Water-plant SOC already knows the jump-host name for a hunt, but the draft search filters only on a search-time field after scanning the whole index. What should the analyst add to the first clause?
Select an answer to reveal the explanation.
Short Explanation
If the plant already knows the jump box name, put host in the first clause. That is cheap indexed metadata, like using the building directory instead of opening every filing cabinet. Search-time fields, lookups, and eventstats can wait until the index has already sought that host.
Full Explanation
host and source are indexed metadata; filtering on them in the first clause lets Splunk seek matching tsidx entries instead of reading every event and then applying a search-time field. Leading wildcards, whole-table Asset and Identity lookups, and eventstats across all hosts reverse the cheap-to-expensive order. When the civic hunt already knows the jump-host name, that knowledge belongs with index, sourcetype, and time—not after a full index scan.