A.chart sales by product_name

B.chart sum(price) as sales by product_name

C.stats sum(price) as sales over product_name

D.timechart list(sales), values(product_name)

A.Tag-<field?

B.Tag<filed(tagname.)

C.Tag=<filed>::<tagname>

D.Tag::<filed>=<tagname>

A.endswith

B.maxspan

C.maxduration

D.maxpause

A.Use the scats command when you next to group events by two or more fields.

B.The stats command is faster and more efficient than the transaction command

C.The transaction command is faster and more efficient than the stats command.

D.Use the transaction command when you want to see the results of a calculation.

A.tag=Priv

B.tag=Priv*

C.tag=privileged

D.tag=priv*