An analyst is looking for known C2 communication in a few billion NetFlow records, using a query similar to the following: index=network sourcetype=netflow src_...