When should you use the transaction command instead of the scats command?

• A.When you need to group on multiple values.
• B.When you need to group based on start and end constraints.
• C.When you have over 1000 events in a transaction.
• D.When duration is irrelevant in search results. .

Comment: *

Name: *

Email: *

Verification: *

This search user!=*_________________.

• A.displays all events
• B.displays only events that contain a value for user
• C.displays only events that do NOT contain a value for user

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements is true, especially in largo environments?

• A.Use the scats command when you next to group events by two or more fields.
• B.The transaction command is faster and more efficient than the stats command.
• C.Use the transaction command when you want to see the results of a calculation.
• D.The scats command is faster and more efficient than the transaction command

Comment: *

Name: *

Email: *

Verification: *

The eval command 'if' function requires the following three arguments (in order):

• A.Result if false, result if true, boolean expression
• B.Result if true, result if false, boolean expression
• C.Boolean expression, result if false, result if true
• D.Boolean expression, result if true, result if false

Comment: *

Name: *

Email: *

Verification: *

When using the transaction command, what does the argument maxspan do?

• A.Sets the maximum total time between events in a transaction.
• B.Sets the maximum length of all events within a transaction.
• C.Sets the maximum total time between the earliest and latest events in a transaction.
• D.Sets the maximum length that any single event can reach to be included in the transaction.

Comment: *

Name: *

Email: *

Verification: *