A.Eval fields

B.Calculated fields

C.Field extractions

D.Calculated lookups

A.Fast mode

B.Verbose mode

C.Smart mode

A.Sourcetype=access_* |stats sum by host

B.Sourcetype=access_* |sum(bytes) by host

C.Sourcetype=access_* |sum bytes by host

D.Sourcetype=access_* |stats sum(categorylD. by host

A.Tags are designed to make data more understandable.

B.Tags are case-insensitive.

C.Tags are based on field/vale pairs.

D.Tags categorize events based on a search.

A.Calculated fields are a shortcut for repetitive and complex eval commands.

B.Calculated fields are a shortcut for repetitive and complex calc commands.

C.Calculated fields are only used on fields added by lookups.

D.Calculated fields automatically calculate the simple moving average for indexed fields.