A.state can only group events using IP addresses.

B.The transaction command is faster and more efficient.

C.There is a 1000 event limitation with the transaction command.

D.Use state when the events need to be viewed as a single event.

A.The average time between each transaction

B.The average time for each event within each transaction

C.The average time elapsed during each transaction for all transactions

A.CIM does not work with different names for the same field.

B.Macros.

C.The rename command.

D.Field aliases.

A.Auto-Extracted fields can be given a friendly name for use in Pivot.

B.Auto-Extracted fields can have their data type changed.

C.Auto-Extracted fields can be hidden in Pivot.

D.Auto-Extracted fields can be added if they already exist in the dataset with constraints.

A.POST workflow actions cannot use field values in their URI.

B.POST workflow actions are always encrypted.

C.POST workflow actions can open a web page in either the same window or a new .

D.POST workflow actions cannot be created on custom sourcetypes.