## Query Optimization: Speed is Survival

In a crisis, waiting 15 minutes for a search to complete is unacceptable. You must write efficient queries.

### 1. The "Left-to-Right" Rule (Pipeline Processing)
Most SIEMs process data in a pipeline. You want to filter the massive dataset **as early as possible** (on the left side).

*   **Bad Splunk Query**:
    `index=main | regex "password" | where status=200`
    *   Why? The index contains 1 Billion events. It pulls ALL of them, runs a heavy Regex on ALL of them, and *then* checks status.
*   **Good Splunk Query**:
    `index=main status=200 "password"`
    *   Why? It effectively uses the "index" to only retrieve events that already have `status=200` and the string "password". It might retrieve only 100 events.

### 2. Avoid "Leading Wildcards"
*   `index=main user=*bob`
*   Why is this bad? The database is indexed alphabetically.
    *   `abc`
    *   `bob`
    *   `zack`
    *   If you search `bob*`, it jumps to "B" instantly.
    *   If you search `*bob`, it must scan `abc`, `bob`, `zack`... literally every single word in the dictionary to see if it ends in "bob". It destroys CPU.

### 3. Specify Time Ranges
*   Never search "All Time".
*   Always narrow down to "Last 60 minutes" or "Specific Date Window".

### 4. Fast Mode vs. Verbose Mode
*   **Fast Mode**: Returns only field summary/statistics. (Super fast).
*   **Verbose Mode**: Returns every raw event text. (Slow).
*   If you just need a count (`stats count`), use Fast Mode.