What are the two parts of a root event dataset?

• A.Fields and variables.
• B.Fields and attributes.
• C.Constraints and fields.
• D.Constraints and lookups.

Comment: *

Name: *

Email: *

Verification: *

When using the transaction command, what does the argument maxspan do?

• A.Sets the maximum total time between the earliest and latest events in a transaction.
• B.Sets the maximum length that any single event can reach to be included in the transaction.
• C.Sets the maximum total time between events in a transaction.
• D.Sets the maximum length of all events within a transaction.

Comment: *

Name: *

Email: *

Verification: *

Which of the following searches will return events containing a tag named Privileged?

• A.tag=Priv
• B.tag=Priv*
• C.tag=priv*
• D.tag=privileged

Comment: *

Name: *

Email: *

Verification: *

When using | timechart by host, which field is represented in the x-axis?
date

• A.host
• B.time
• C._time

Comment: *

Name: *

Email: *

Verification: *

Which delimiters can the Field Extractor (FX) detect? (select all that apply)

• A.Tabs
• B.Pipes
• C.Spaces
• D.Commas

Comment: *

Name: *

Email: *

Verification: *