A.Only in a large distributed Splunk environment.

B.When calculating results from one or more fields.

C.When event grouping is based on start/end values.

D.When grouping events results in over 1000 events in each group.

A.index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status

B.index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states

C.None of these searches would generate a similart graph.

D.index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time

A.index=main REJECT | transaction sessionid

B.index=main | transaction sessionid | search REJECT

C.index=main | transaction sessionid | where transaction="REJECT*"

D.index=main | transaction sessionid | where transaction=reject

A.date

B.host

C.time

D._time

A.Index=main | transaction sessionid | whose transaction=reject

B.Index=main | transaction sessionid | where transaction=reject''

C.Index-main | transaction sessionid | search REJECT

D.Index-main | REJECT trans sessionid