問題文
An analyst has written a search that reads 60 days of proxy logs, keeps only three columns, and then filters down to a single department. A colleague says the filter should move. Where should it go, and why?
選択肢
- Immediately before the command that keeps the columns, because a filter that runs after columns have been removed produces incorrect results.
- As far right as possible, because the platform optimizes the pipeline from the end backward and therefore prefers filters that are close to the final output.
- As far left as possible, because filtering early reduces how much data the later commands have to handle.
- It makes no difference, because the platform reorders the pipeline itself in any case.