________ context is to index time as _______ context is to search time.

The relationship presented in the question emphasizes how different contexts work at various stages of data processing in Splunk. The correct answer highlights that "Global context" pertains to index time, while "App/User context" relates to search time.

At index time, Global context refers to settings that apply across the entire Splunk environment, impacting how data is indexed regardless of its source. This includes configurations that affect all users and Splunk applications, thereby establishing a uniform foundation for data ingestion and indexing.

Conversely, App/User context at search time allows for configurations specific to individual applications or users that tailor the data that users see and how they interact with it. This context can govern permissions, data visibility, and specialized configurations relevant to particular applications or user roles, making the data more relevant and useful at the search phase.

This distinction illustrates how Global settings provide overarching control and consistency during data indexing, while App/User settings enhance user experience and data relevance during searches.