A county hunt for unusual library-kiosk logons is slow because the search runs a lookup and several eval transforms before any index filter. Which order should the analyst apply?
Select an answer to reveal the explanation.
Short Explanation
Cheap filters first, fancy math last. Time, index, sourcetype, and host-style indexed fields cut the haystack; then tstats or CIM and fields; then eval/rex; lookup at the end. Running lookup or eval on index=* is mowing the whole county to find one kiosk.
Full Explanation
Splunk efficient-search order for a civic hunt is cheapest constraints first: time range, index, sourcetype, and other indexed metadata, then accelerated CIM/tstats and a fields command to limit payload, then search-time transforms, then lookup. Reversing that order forces Splunk to extract, look up, or group events that would have been discarded by an early index filter. lookup-first, rex-on-index=*, and transaction-across-all-indexes are the anti-patterns this checklist is meant to catch.