A.Events datasets

B.Search datasets

C.Transaction datasets

D.Any child of event, transaction, and search datasets

A.Providing templates for reports and dashboards.

B.Algorithmically shifting events to other indexes.

C.Reingesting previously indexed data with new field names.

D.Normalizing data across a Splunk deployment.

A.Calculated fields can be used in the search bar.

B.Calculated fields can be based on an extracted field.

C.Calculated fields can only be applied to host and sourcetype.

D.Calculated fields are shortcuts for performing calculations using the evalcommand.

A.1

B.5

C.3

D.4

A.Sets the maximum total time between events in a transaction.

B.Sets the maximum length of all events within a transaction.

C.Sets the maximum total time between the earliest and latest events in a transaction.

D.Sets the maximum length that any single event can reach to be included in the transaction.