GRAYLOG - Chapter 8, Exercise 1 Solution
==========================================================
Why Confirm Activity Before Filtering by Level

PROBLEM
-------
In Scenario 1, explain why Step 1 (service + account, no level filter
yet) is worth running before Step 2, rather than jumping straight to
the level-filtered query.

SOLUTION
--------
This chapter's own Scenario 1 walks through the same incremental-
building method Chapter 7 established. Running the unfiltered
service:search AND account:bullhorn-27515 first answers a genuinely
different question than the level-filtered version does: it confirms
this specific account has REAL LOG ACTIVITY on this service at all,
before asking whether any of that activity looks critical or error-
level.

If Step 2 (the level-filtered query) is run first and returns zero
results, there are at least two genuinely different explanations:
either the account has no critical/error activity (a real, useful,
reassuring finding), or something about the query itself is wrong -
per Chapter 2's own real gotcha, a wrong separator in the account value
would ALSO produce zero results, for a completely different reason.

Running Step 1 first rules out the second explanation. If Step 1 shows
real activity, a later zero-result level-filtered query can be trusted
as a genuine "no critical/error activity" finding, not a query mistake.

ANSWER: Step 1 confirms the account and service combination is genuinely
valid and has real log activity, before asking a narrower question about
severity. This separates "the account/service scoping is correct but
nothing critical happened" from "the account/service scoping itself is
wrong" - two very different explanations that would otherwise both look
like the same empty result.

----
WHY THIS WORKS AS AN ANSWER

This directly applies Chapter 7's own real reasoning about incremental
query building - each step being independently checkable is exactly
what lets Step 1's own real result be used as a trustworthy baseline
before interpreting Step 2's own result with confidence.