A.True

B.False

A.All events In a transaction must have the same timestamp.

B.All events in a transaction must have the same sourcetype.

C.All events in a transaction must have the exact same set of fields.

D.All events in a transaction must be related by one or more fields.

A.By going to the Settings menu and clicking Event Types > New.

B.By selecting an event in search results and clicking Event Actions > Build Event Type.

C.By using the searchtypes command in the search bar.

D.By editing the event_type stanza in the props.conf file.

A.True

B.False

A.You cannot use the sort command and the eval command on the same field.

B.Use sort first, then convert the numeric to a string with eval.

C.Convert the numeric to a string with eval first, then sort.

D.It doesn't matter whether eval or sort is used first.