A. Use the rex command.
B. Use the Field Extractor and let it automatically generate a regular expression.
C. Use the Field Extractor and manually edit the generated regular expression.
D. Use the erex command.
A. When using an unaccelerated data model, the search produces a larger result count than withsummariesonly=f.
B. When using an accelerated data model, the search produces a larger result count than withsummariesonly=f.
C. Applies only to accelerated data models.
D. Applies only to unaccelerated data models.
A. [ index::sales AND 192 AND 10 AND 178 AND 170 ]
B. [ index::sales AND 469 10 702 390 ]
C. [ 192 AND 10 AND 178 AND 170 index::sales ]
D. [ AND 10 170 178 192 index::sales ]
A. sistats count by product_id
B. sistats summary index by product_id
C. stats si(product_id)
D. stats count by product_id
A. productswill be converted from a single value field to a multivalue field.
B. All multivalue fields will be converted to single value fields.
C. Separate events will be created for each product inproducts.
D. Compressed values inproductswill be uncompressed.
A. |s is not a valid token filter.
B. To encode URL values.
C. To force no encoding to occur.
D. To wrap a value in double quotes.
A. date_zone
B. date_minute
C. date_day
D. date_year
A. field, host, source
B. No arguments are required.
C. input, output path
D. input, output, index
A. Returns results from only non-summarized data.
B. Returns results from both summarized and non-summarized data.
C. Returns no results.
D. Prevents the use of wildcard characters in aggregate functions.
