A.fields for the object

B.a base search for the object

A.sourcetype=firewall | rare num=15 dest_ip

B.sourcetype=firewall | rare last=15 dest_ip

C.sourcetype=firewall | rare count=15 dest_ip

D.sourcetype=firewall | rare limit=15 dest_ip

A.Only TCP/UDP

B.Filed & Directories, HTTP Event Collector (HEC), TCP/UDP and Scripts

C.Only HTTP Event Collector (HEC) and TCP/UDP

D.None of the above

E.Only Scripts

A.Search & Reporting is the only app that can be set as the default application.

B.Full names can only be changed by accounts with a Power User or Admin role.

C.Time zones are automatically updated based on the setting of the computer accessing Splunk.

D.Full name, time zone, and default app can be defined by clicking the login name in the Splunk bar.

A.Search results can be used to populate a lookup table

B.Lookups can be time based

C.Splunk DB Connect can be used to populate a lookup table from relational databases D .Output from a script can be used to populate a lookup table

D.Lookup have a 10mg maximum size limit