Module 7: Best Practices Flashcards

1
Q

Best practices (5)

A

Limit searches by time (most recent or in a window)
More precise searches (similar to longest prefix)
Inclusion better than exclusion (and better than not)
Apply filtering
Use multiple indexes to segregate data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Time abbreviations

A

s: seconds
m: minutes
h: hours
d: days
w: weeks
mon: month
y: year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Time abbreviation @ symbol

A

rounds down to nearest time unit

-30m@h for 9:37 gives you 9:00-937

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Time search strings (2)

A

Earliest

Latest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Most efficient way to filter events

A

By time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly