Chronicle Security Information and Event Management (SIEM) applies the schema at what point to ensure maximum performance and increase the number of pivots that can be done on data?
Select one that applies, and then click Submit.
- It depends on the parser
- On search
- Some on write, some on search
- On write