SPLK-1002 Exam Question 171

In which of the following scenarios is an event type more effective than a saved search?