Posted by: Pdfprep
Post Date: June 21, 2021
A dashboard is taking too long to load. Several searches start with the same SPL.
How can the searches be optimized in this dashboard? (Select all that apply.)
A . Convert searches to include NOT expressions.
B . Restrict the time range of the search as much as possible.
C . Replace | stats command with | transaction command wherever possible.
D . Convert the common SPL into a Global Search and convert the other searches to post-processing searches.
Answer: CD
Leave a Reply