A county hunt for unusual library-kiosk logons is slow because the search runs a lookup and several eval transforms before any index filter. Which order should the analyst apply?

Efficient SPL order for a county library-kiosk hunt is cheap filters first and expensive transforms last: time, index, sourcetype, and indexed fields; then CIM or tstats and fields pruning; then eval/rex transforms; then lookup. That order shrinks the haystack before Asset and Identity enrichment or calculated fields run on kiosk authentication events. Lookup first before time is applied can still force enrichment work across an oversized set and does not replace time bounding. rex and eval on index=* before choosing a sourcetype mows the whole county to find one kiosk pattern. transaction across all indexes before hourly filtering is a classic anti-pattern for this workflow. Exam caveat: if a lookup is required to obtain the filter key itself, keep that lookup tiny and selective—do not use that exception to justify enrichment-first on unbounded searches. Operational check: reorder the kiosk hunt to the time→index→sourcetype→indexed fields→tstats/fields→transforms→lookup sequence, measure runtime against the old lookup-first draft, and save the ordered template for county analysts. Document the revised approach in the civic SOC runbook so the next on-call analyst inherits the correct pattern rather than the anti-pattern. Retain Job Inspector evidence with the change ticket for municipal audit readiness.