A.True

B.False

A.Click All Fields and select the field to add it to Selected Fields.

B.This scenario isn't possible because all fields returned from a search always appear in the fields sidebar.

C.Click Selected Fields and select the field to add it to Interesting Fields.

D.Click Interesting Fields and select the field to add it to Selected Fields.

A.(index=web OR index=sales)

B.index=web OR index=s"

C.index=*

D.*index=sales AND index= web

A.Splunk DB Connect can be used to populate a lookup table from relational databases

B.Lookups can be time based

C.Lookup have a 10mg maximum size limit

D.Search results can be used to populate a lookup table

E.Output from a script can be used to populate a lookup table

A.Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

B.Will display result depending on the data.

C.Will return event where status field exist but value of that field is not 100.