Which of the following searches show a valid use of a macro? (Choose all that apply.)

• A.index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
• B.index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
• C.index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField
• D.index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField

Comment: *

Name: *

Email: *

Verification: *

When using | timechart by host, which field is represented in the x-axis?

• A.date
• B.host
• C.time
• D._time

Comment: *

Name: *

Email: *

Verification: *

Which of the following searches would return a report of sales by product-name?

• A.chart sales by product_name
• B.chart sum(price) as sales by product_name
• C.stats sum(price) as sales over product_name
• D.timechart list(sales), values(product_name)

Comment: *

Name: *

Email: *

Verification: *

What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

• A.The user is unable to return to the automatic field extraction workflow.
• B.The user is unable to preview the extractions.
• C.There is a limit to the number of fields that can be extracted.
• D.The extraction is added at index time.

Comment: *

Name: *

Email: *

Verification: *

What is the relationship between data models and pivots?

• A.Pivots and data models are the same thing.
• B.Pivots provide the datasets for data models.
• C.Pivots and data models have no relationship.
• D.Data models provide the datasets for pivots.

Comment: *

Name: *

Email: *

Verification: *