Choosing the Right Search Method to Optimize AVC Usage

Every search you run in Anomali Search consumes AVC units. The method you choose, the time range you set, and the data source you target all determine how much work the system must do — and therefore how many AVC units your query costs.

Anomali Search provides four search methods. Each serves a different purpose and carries a different AVC cost. Choosing the right one for the task at hand is the single most effective way to control resource consumption.

Search Method	AVC Cost
Field-based Search	eventlog (Default) ▼ Low — uses parsed and indexed fields; fastest for hot-data queries when the schema is known. OCSF Search ▼ Low — equivalent cost to Event Log parsed-field queries; uses the ocsf table and dotted-notation fields instead of eventlog; queries must specify a category_name constraint.
Turbosearch (Accelerated)	▼ Low–medium — indexed field lookups are fast and efficient; recommended over message contains for any exact-value search on indexed fields.
Full-Text Search (Keyword)	▼ Low–medium — cheaper than message contains for exact token matches; no wildcards or partial matches — exact match only.
Table / Lookup Search (Enriched)	▼ Very low — queries a small, pre-correlated dataset instead of the full eventlog; requires the table name to be specified explicitly at the start of the query.

Why Raw Message Scans (message contains) Are Expensive

When Anomali Search receives a query that uses | where message contains_ci, it must read every raw log line stored in the specified time range and check whether the search string appears anywhere inside it. For a 24-hour window with high-volume data, that can mean millions of records scanned. For a 90-day window, the cost multiplies accordingly.

Event Log Search — Parsed Fields

Parsed fields eliminate the raw-scan problem. During ingestion, Anomali extracts known values from your logs — usernames, IP addresses, hostnames, event names — and stores them in structured columns. A query on a parsed field reads only that column, not the full raw message. The system returns results faster and consumes a fraction of the AVC units.

Use Case	Avoid	Recommended
Finding a user	| where message contains_ci ("John")	user = "John"
Finding by IP address	| where message contains_ci ("192.168.1.10")	src_ip = "192.168.1.10"
Finding a file hash	| where message contains_ci ("3b4c5a48c45a4c3b56a2")	file_hash = "3b4c5a48c45a4c3b56a2"

Turbosearch — High-Speed Indexed Search

Turbosearch is a dedicated high-speed search operator that queries a set of pre-built indexed fields directly, bypassing the need to scan raw log records. Because it operates on an index rather than the full message text, it returns results significantly faster and at lower AVC cost than equivalent raw-message or standard parsed-field queries — especially over larger time windows.

Full-Text Search — When a Value May Not Be in an Indexed Field

Full-text search uses a pre-built index on the raw message, so it finds exact token matches without reading every record from scratch. This makes it significantly cheaper than a raw message scan.

Use full-text search when you need to search the raw message for an exact value and that value does not have a corresponding parsed field in the eventlog schema. The classic use cases are email addresses, URLs, or unique identifiers that are not extracted as named columns during ingestion.

Use Case	Avoid	Recommended
Searching for an email address	| where message contains_ci ("john.doe@company.com")	"john.doe@company.com" | where sourcetype="email_logs"

Table / Lookup Search — Lowest-Cost Option for Enriched Data

Anomali maintains pre-correlated datasets — such as iocmatch, ignite, and threat_models — that contain the results of correlation work already performed by the platform. Querying these tables is significantly cheaper because the scanned dataset is a fraction of the size of the full event log.

The key to keeping costs low is to name the target table explicitly at the start of the query. If you omit the table name, the query defaults to scanning the full eventlog.

Use Case	Avoid (Higher AVC)	Recommended (Lower AVC)
Checking IOC matches	eventlog | where action in ('allow', 'accept') | where src_ip = "1.2.3.4"	iocmatch | where action in ('allow', 'accept')

Searching Archived Data Beyond 90 Days

By default, Anomali Search queries only hot data — event logs from the past 90 days stored in fast, searchable hot buckets. After 90 days, data automatically moves to archive buckets, where it is retained according to the terms of your license agreement. Archived data is not searchable by default; access is restricted.

To search archived data, submit a support ticket to have your account configured for archive searching. Once enabled, use eventlog, Turbosearch, or full-text search as appropriate.