A.Paste it into Notepad.

B.Click the "Add IOC" button.

C.Click the "Add Artifact" button.

D.Add it in a text note to the investigation.

A.Upload the lookup file in Settings -> Lookups -> Lookup Definitions

B.Upload the lookup file in Settings -> Lookups -> Lookup table files

C.Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups

D.Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

A.summaryHomePath

B.warmToColdScript

C.thawedPath

D.tstatsHomePath

A.When adding apps to the deployment server.

B.Splunk_TA_ForIndexers.spl is installed first.

C.After installing ES on the search head(s) and running the distributed configuration management tool.

D.Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command.

A.Indexers might crash.

B.Indexers might be processing.

C.Indexers might not be reachable.

D.Indexers have different settings.