Which of the following is a reason to utilize an index-based search (index=...) over a data model search (| tstats...) in a detection?

The correct answer is B. When fields contained in raw data provide more details than what is contained in the data model. An index-based search should be used when the raw event fields contain more detail than the data model. Data models normalize and may omit certain fields, so searching the index directly ensures all relevant information is available for the detection.

Custom Content Development

Question

Which of the following is a reason to utilize an index-based search (index=…) over a data model search (| tstats…) in a detection?

Options

AIndex-based searches can utilize macros for ease of configuration and maintenance.
BWhen fields contained in raw data provide more details than what is contained in the data model.
CData model searches are more CPU intensive and thus fewer can run concurrently.
DIndex-based searches are more efficient as they have direct access to the raw data.

How the community answered

(26 responses)

A
4% (1)
B
73% (19)
C
8% (2)
D
15% (4)

Explanation

An index-based search should be used when the raw event fields contain more detail than the data model. Data models normalize and may omit certain fields, so searching the index directly ensures all relevant information is available for the detection.

Topics

#index-based search#tstats#data model#raw data fields

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice