Which of the following statements describe data model acceleration? (Choose all that apply.)

• A.Root events cannot be accelerated.
• B.Accelerated data models cannot be edited.
• C.Private data models cannot be accelerated.
• D.You must have administrative permissions or the accelerate_datamodelcapability to accelerate a data model.

Comment: *

Name: *

Email: *

Verification: *

Which of the following searches show a valid use of macro? (Select all that apply)

• A.index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
• B.index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
• C.index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
• D.index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField

Comment: *

Name: *

Email: *

Verification: *

Which of the following knowledge objects represents the output of an oval expression?

• A.Eval fields
• B.Calculated lookups
• C.Calculated fields
• D.Field extractions

Comment: *

Name: *

Email: *

Verification: *

When using | timechart by host, which field is represented in the x-axis?

• A.date
• B.host
• C.time
• D._time

Comment: *

Name: *

Email: *

Verification: *

Which of the following can be used with the evalcommand tostringfunction? (Choose all that apply.)

• A."hex"
• B."commas"
• C."decimal"
• D."duration"

Comment: *

Name: *

Email: *

Verification: *