MENU
What are the two most efficient search filters?
41 comments · newest first
TE
Tennie
10 months ago
Really? Index and sourcetype? That’s surprising!
RU
Ruth
10 months ago
I agree, those are super efficient!
AL
Alberto
10 months ago
Wait, are you sure about that? I thought time and host were better.
JA
Jackie
10 months ago
I always use time and host, seems to work fine for me.
MA
Marica
11 months ago
I think it's definitely index and sourcetype.
DA
Dana
11 months ago
I definitely remember that time is crucial, but I can't decide between index and sourcetype for the second one.
YU
Yun
11 months ago
I’m a bit confused; I thought host was important too, but I can't recall if it was the most efficient.
DE
Denise
11 months ago
I practiced a similar question, and I feel like index and sourcetype were mentioned as key filters.
LA
Lamar
12 months ago
I think I remember something about using time filters being really efficient, but I'm not sure about the second one.
JI
Jill
12 months ago
I'm a bit confused on this one. I know _time is crucial, but the other options all seem reasonable as well. I'll have to review my notes on efficient search strategies before deciding.
TI
Timothy
12 months ago
Okay, let me think this through step-by-step. _time is definitely the most important filter to narrow down the search, so that's a given. Then it's a choice between host, index, or sourcetype as the second filter. I'm leaning towards A - _time and host, since host can help further refine the search, but I'm not 100% sure.
WI
Wilda
1 year ago
Hmm, I'm not sure about this one. I know _time is important for efficient searches, but I'm not sure if host or index would be the better second filter. I'll have to think this through carefully.
SH
Shizue
1 year ago
This looks like a straightforward question about the most efficient search filters. I'm pretty confident that the answer is A - _time and host.
WI
Willard
1 year ago
This question is making me _host-ile. I'm going to have to go with C. Host and sourcetype. Seems like the most _source-ful choice to me.
JE
Jestine
1 year ago
I see your point, but I still think host and sourcetype are the best options for search filters.
LE
Lelia
1 year ago
I disagree, I think the correct answer is D. Index and sourcetype are the most efficient search filters.
CA
Carey
1 year ago
I'm feeling a bit _time-ly today, so I'm going to have to go with B. _time and index. Gotta love those efficient filters!
RE
Reiko
1 year ago
Yeah, those filters make searching a breeze. Good choice!
SC
Scarlet
1 year ago
I agree, _time and index are definitely the way to go for efficient searching.
SO
Sol
1 year ago
Definitely C. Host and sourcetype. I mean, that's the bread and butter of efficient searching, right?
SA
Sarah
1 year ago
Index and sourcetype are crucial for narrowing down search results quickly.
DE
Deonna
1 year ago
I think _time and host are more important for filtering search results.
JU
Jutta
1 year ago
I agree, host and sourcetype are essential for efficient searching.
JU
Justine
1 year ago
D. Index and sourcetype, no doubt. That's the most efficient way to search and get the results you need, hands down.
SI
Simona
1 year ago
It really depends on the specific search criteria, but index and sourcetype are generally a good starting point.
DE
Derick
1 year ago
I find that using _time and host can also be quite effective in narrowing down search results.
RO
Rochell
1 year ago
I agree, index and sourcetype are definitely the way to go for efficient searching.
HO
Hortencia
1 year ago
I personally prefer using index and sourcetype as search filters, they work better for me.
FR
Francene
1 year ago
Hmm, this is a tough one. I'm going to have to go with D. Index and sourcetype. Seems like the most logical choice to me.
RO
Rodolfo
1 year ago
I'm going with A. _time and host are the two most important filters. Time is key, and you can't forget about the host!
LE
Lenny
1 year ago
B. _time and index are the way to go. Filtering by time and index is super efficient for quickly finding the data you need.
RO
Ronald
1 year ago
C. Host and sourcetype seems like the obvious choice here. You need to filter by the host and the type of data to get the most efficient results.
VA
Vanda
1 year ago
I think the answer is D. Index and sourcetype are the most efficient search filters, as they allow you to quickly narrow down your search results.
NA
Nan
1 year ago
I find that using host and sourcetype together can help me pinpoint exactly what I'm looking for.
PA
Page
1 year ago
I think it's actually A. _time and host are crucial for narrowing down search results.
TR
Truman
1 year ago
I always use index and sourcetype to quickly find the information I need.
RE
Reita
1 year ago
I agree, index and sourcetype are definitely the most efficient search filters.
EZ
Ezekiel
1 year ago
I think _time and host are also important filters to consider when searching for specific data.
AR
Aron
1 year ago
I agree, index and sourcetype are definitely the most efficient search filters.
CU
Curt
1 year ago
I agree with Solange, _time and host are definitely the best filters.
SO
Solange
1 year ago
I think the two most efficient search filters are _time and host.