Which of the following SPL searches is likely to return results the fastest?

The correct answer is C. index=network sourcetype=netflow src_ip=1.2.3.4 src_port=2938. Chosen option is the most efficient because it restricts the search to a specific index and sourcetype and applies all field filters (src_ip, src_port, protocol) at the very start. This minimizes the volume of data scanned before invoking the lighter-weight stats command…

Security Data Onboarding and Normalization

Question

Options

Asrc_port=2938 AND protocol=tcp | stats count by src_ip | search
Bindex=network src_port=2938 protocol=tcp | stats count by src_ip |
Cindex=network sourcetype=netflow src_ip=1.2.3.4 src_port=2938
Dsrc_ip=1.2.3.4 src_port=2938 protocol=tcp | stats count

How the community answered

(35 responses)

A
6% (2)
B
14% (5)
C
77% (27)
D
3% (1)

Explanation

Chosen option is the most efficient because it restricts the search to a specific index and sourcetype and applies all field filters (src_ip, src_port, protocol) at the very start. This minimizes the volume of data scanned before invoking the lighter-weight stats command, making it faster than searches that leave out index/sourcetype constraints or postpone filtering.

Topics

#SPL optimization#search performance#index filtering#sourcetype filtering

Community Discussion

No community discussion yet for this question.

Full SPLK-5001 Practice