A.Search results can be used to populate a lookup table

B.Output from a script can be used to populate a lookup table

C.Splunk DB Connect can be used to populate a lookup table from relational databases

D.Lookup have a 10mg maximum size limit

E.Lookups can be time based

A.Relative

B.Date Range

C.Advanced

D.Presets

E.Date & Time Range

A.Splunk only extracts the most interesting data from the last 24 hours.

B.Splunk only extracts fields users have manually specified in their data.

C.Splunk automatically extracts any fields that generate interesting visualizations.

D.Splunk automatically discovers many fields based on sourcetype and key/value pairs found in the data.

A.10 Minutes

B.15 Minutes

C.1 Day

D.7 Days

A.Any naming convention is fine as long as you keep an external spreadsheet to keep track

B.Use a consistent naming convention so they are easily separated by characteristics such as group and object

C.Reports are best named using many numbers so they can be more easily sorted

D.Name reports as uniquely as possible with no overlap to differentiate them from one another