A.True

B.False

A.index=security failure | stats sum as "Event Count"

B.index=security failure | stats count by "Event Count"

C.index=security failure | stats count as "Event Count"

D.index=security failure | stats dc(count) as "Event Count"

A.Expands the time range of the search.

B.Filters current search results.

C.Executes a new search.

D.Moves to past or future events.

A.Lookups can be time based

B.Search results can be used to populate a lookup table

C.Splunk DB Connect can be used to populate a lookup table from relational databases

D.Lookup have a 10mg maximum size limit

E.Output from a script can be used to populate a lookup table

A.The lookup definition must be created.

B.The lookup file must be verified using the inputlookup command.

C.The lookup file must be uploaded to Splunk.

D.The lookup command must be used.