A security analyst needs to create a data model for authentication logs that allows both event counts and average duration calculations. The data model should support fast search performance. Which approach best follows Splunk best practices for data model design?
Select one:
Splunk often tests the misconception that transactions should be used at the root level for all calc...