A.Will return event where status field exist but value of that field is not 100.

B.Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

C.Will get different results depending on data.

A.index=security error OR fail

B.index=security Error Fail

C.index=security "error failure"

D.index=security NOT error NOT fail

A.None of the above.

B.Both One-time and continuous monitoring

C.Only One-time monitoring.

D.Only continuous monitoring.

A._raw

B.index

C._host

D.host

A.No

B.Yes