Q: 7
What are the two most efficient search filters?
Options
Discussion
Its B, seen similar on practice with Splunk. Index and _time are fastest for bucket filtering from what I remember.
D is wrong, B. Splunk uses index and _time first for disk-level filtering, so that's way more efficient in practice.
Option D, since index and sourcetype are super efficient in most real Splunk use cases, not sure why B is picked.
B for sure, since index and _time let Splunk skip the most data right away by narrowing the search before looking at anything else. Official docs and a few practice questions mention this, but if anyone's seen something different in their exam prep let me know.
B
Its B. Index and _time get applied before other filters in Splunk, so they're way more efficient. I see a lot of folks pick host/sourcetype since they're common fields, but they're not filtered first. Pretty sure about this but open to corrections.
Why is D more efficient than B in initial disk-level filtering? Pretty sure Splunk uses index plus _time first.
B not D. Splunk uses index and _time to narrow data right at the disk level, which is way faster than filtering by sourcetype or host. Sourcetype is more common in queries but isn't as efficient in actual bucket selection. Pretty sure about this, but open to other takes.
D tbh, index and sourcetype are super common to filter by in real searches. Host can be a trap here.
B or D? Not confident, but B seems right from how Splunk uses index and time.
Be respectful. No spam.
