A.CIM is a methodology for normalizing data.

B.CIM can correlate data from different sources.

C.The Knowledge Manager uses the CIM to create knowledge objects.

D.CIM is an app that can coexist with other apps on a single Splunk deployment.

A.Calculated fields can be used in the search bar.

B.Calculated fields can be based on an extracted field.

C.Calculated fields can only be applied to host and sourcetype.

D.Calculated fields are shortcuts for performing calculations using the eval command.

A.GET

B.PUT

C.Search

D.UPDATE

A.Changes made manually can be reverted in the Field Extractor (FX) UI.

B.It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.

C.It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.

D.The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.

A.Tabs

B.Spaces

C.Colons

D.Pipes