Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Timechart

Explanation
The searches A and C show a valid use of a macro. A macro is a reusable piece of SPL code that can be called by using single quotes (''). A macro can take arguments, which are passed inside parentheses after the macro name. For example, 'makeMyField(oldField)' calls a macro named makeMyField with an argument oldField.
The searches B and D are not valid because they use double quotes ("") instead of single quotes ('').

Data models and pivot are both knowledge objects in Splunk that allow you to analyze and visualize your data
in different ways. Data models are collections of datasets that represent your data in a structured and
hierarchical way. Data models define how your data is organized into objects and fields. Pivot is a user
interface that allows you to create data visualizations that present different aspects of a data model. Pivot does
not require users to input SPL searches on data models, but rather lets them select options from menus and
forms. Data models are not created out of datasets called pivots, but rather pivots are created from datasets in
data models.

When you mouse over and click to add a search term from the Fields sidebar or from an event in your search
results, Splunk automatically adds the term to your search string with an implied ANDoperator2. However,
this does not apply to some Boolean operators such as OR, NOT and parentheses (). These operators are not
implied when you add a search term and you have to type them manually if you want to use them in your
search string2. Therefore, options A, B and D are correct, while option C is incorrect because AND is implied
when you add a search term.