Water-plant SOC already knows the jump-host name for a hunt, but the draft search filters only on a search-time field after scanning the whole index. What should the analyst add to the first clause?
Select an answer to reveal the explanation.
Short Explanation
If the plant already knows the jump box name, put host in the first clause. That is cheap indexed metadata, like using the building directory instead of opening every filing cabinet. Search-time fields, lookups, and eventstats can wait until the index has already sought that host.
Full Explanation
When the water-plant SOC already knows the jump-host name, put the indexed host field—and source if known—in the first search clause so Splunk can seek cheap metadata before scanning for search-time fields. Indexed host and source filters prune buckets early; filtering only on a search-time field after a whole-index scan wastes that advantage on OT hunts. A leading wildcard on process name before host is known fights index efficiency. Looking up the entire Asset and Identity table before any index or host filter is not a substitute for seeking the known jump host. eventstats across all hosts after a full scan computes comparisons too late and too broadly. Exam caveat: host must match how events are tagged (short name versus FQDN); a wrong host string looks like an empty hunt even when logs exist. Operational check: rerun the jump-host hunt with host= and optional source= in the first clause, confirm events return, and compare scanned buckets to the search-time-only filter version. Document the revised approach in the civic SOC runbook so the next on-call analyst inherits the correct pattern rather than the anti-pattern. Retain Job Inspector evidence with the change ticket for municipal audit readiness.