SPLK-1002 Exam Question 131
What will you learn from the results of the following search?
sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration)
sourcetype=cisco_esa | transaction mid, dcid, icid | timechart avg(duration)
SPLK-1002 Exam Question 132
What other syntax will produce exactly the same results as | chart count over vendor_action by user?
SPLK-1002 Exam Question 133
Which of the following statements describes POST workflow actions?
SPLK-1002 Exam Question 134
By default search results are not returned in ________ order.
SPLK-1002 Exam Question 135
Which of the following searches show a valid use of macro? (Select all that apply)


