A.A macro is a reusable search string that must contain the full search.

B.A macro is a reusable search string that must have a fixed time range.

C.A macro Is a reusable search string that may have a flexible time range.

D.A macro Is a reusable search string that must contain only a portion of the search.

A.Use the scats command when you next to group events by two or more fields.

B.The transaction command is faster and more efficient than the stats command.

C.The stats command is faster and more efficient than the transaction command

D.Use the transaction command when you want to see the results of a calculation.

A.tag=Priv

B.tag=Priv*

C.tag=priv*

D.tag=privileged

A.newField
index=main source=mySource oldField=* | stats if('makeMyField(oldField)') |

B.table _time newField
index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'|

C.table _time newField
index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'"

D.| table _time newField

A.Events will be returned from the data model named All_Application_state.

B.Events will be returned from dataset named Application_state.

C.No events will be returned because the pipe should occur after the datamodel command

D.Events will be returned from the data model named Application_State.