A.index=*

B.*index=sales AND index= web

C.index=web OR index=s"

D.(index=web OR index=sales)

A.All events that either have a hostof www3or a statusof 503.

B.All events with a hostof www3that also have a statusof 503.

C.We need more information; we cannot tell without knowing the time range.

D.We need more information; a search cannot be run without specifying an index.

A.2

B.4

C.1

D.3

A.Splunk automatically discovers only manually configured fields

B.Splunk automatically discovers only fields directly related to the search results

C.Splunk automatically discovers only numeric fields

D.Splunk automatically discovers only alphanumeric fields

A.No

B.Yes