Which stats function is used to return a sorted list of unique field values?
What capability does a power user need to create a Log Event alert action?
How can the erex and rex commands be used in conjunction to extract fields?
When working with an accelerated data model acc_datmodel and an unaccelerated data model unacc_datmodel, what tstats query could be used to search one of these data models?
When using thebincommand, what attributes are used to define the size and number of sets created?
Which Job Inspector component displays the time taken to process field extractions?
When enabled, what drilldown action is performed when a visualization is clicked in a dashboard?
How can an underlying search be optimized to improve dashboard performance?
What type of drilldown passes a value from a user click into another dashboard or external page?
What is an example of the simple XML syntax for a base search and its post-process search?
Consider the following search:
(index=_internal log group=tcpin connections) earliest
| stats count as _count by sourceHost guid fwdType version
| eventstats dc(sourceHost) as dc_sourceHost by guid
| where dc_sourceHost > 1
| fields - dc_sourceHost
| xyseries guid fwdType sourceHost
| search guid="00507345-CE09-4A5E-428-D3E8718CB065"
| appendpipe [ stats count | eval "Duplicate GUID" = if(count==0, "Yes", "No") ]
Which of the following are transforming commands?
What is the recommended way to create a field extraction that is both persistent and precise?
When running a search, which Splunk component retrieves the individual results?
When possible, what is the best choice for summarizing data to improve search performance?
When a user opens a dataset in Pivot that has not been accelerated, an ad hoc data model acceleration is created. How long does this accelerated data model last?