What are the two most efficient search filters?

The correct answer is B. _time and index. This is the correct answer because these two filters can help you limit the amount of data that Splunk retrieves from disk, which is the key to fast searching1. The _time filter allows you to specify a narrow time window for your search, which reduces the number of buckets that…

Basic Searching

Question

Options

A_time and host
B_time and index
Chost and sourcetype
Dindex and sourcetype

How the community answered

(31 responses)

A
13% (4)
B
77% (24)
C
3% (1)
D
6% (2)

Explanation

This is the correct answer because these two filters can help you limit the amount of data that Splunk retrieves from disk, which is the key to fast searching1. The _time filter allows you to specify a narrow time window for your search, which reduces the number of buckets that Splunk scans. The index filter allows you to specify which index or indexes contain the data that you want to search, which reduces the number of files that Splunk reads.

Topics

#search efficiency#index filter#time filter#search optimization

Community Discussion

No community discussion yet for this question.

Full SPLK-1001 Practice