A.Lookups contain static data available in the index

B.Lookups pull data at index time and add them to search results

C.Lookup fields cannot be used in searches

D.Lookups add more fields to results returned by a search

A.They must be lowercase.

B.They must be uppercase.

C.They must be in quotations.

D.They must be in parentheses.

A.Red

B.Blue

C.Orange

D.Highlighted

A.No events will be returned.

B.Splunk will prompt you to specify an index.

C.All non-indexed events to which the user has access will be returned.

D.Events from every index searched by default to which the user has access will be returned.

A.A field that appears in every event

B.A field that appears in the top 10 events

C.A field that appears in at least 20% of the events

D.A field that appears in any event