A.Search head, SQL database, forwarder

B.Search head, SSD, heavy weight agent

C.Search head, indexer, forwarder

D.Search head, GPU, streamer

A.True

B.False

A.To group the results by one or more fields.

B.To compute numerical statistics on each field.

C.To specify how the values in a list are delimited.

D.To partition the input data based on the split-by fields.

A.There is no functionality like click and drag in Splunk's timeline.

B.Using this option executes a new query.

C.The new result after selecting the range by dragging filters the events and displays the most recent first.

D.This doesn't execute a new query

A.Lookup fields cannot be used in searches.

B.Lookups contain static data available in the index.

C.Lookups add more fields to results returned by a search.

D.Lookups pull data at index time and add them to search results.