A.Will return event where status field exist but value of that field is not 100.

B.Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

C.Will get different results depending on data.

A.Lookups add more fields to results returned by a search

B.Lookups pull data at index time and add them to search results

C.Lookup fields cannot be used in searches

D.Lookups contain static data available in the index

A.Alerts are based on searches and when triggered will only send an email notification.

B.Alerts are based on searches that are either run on a scheduled interval or in real-time

C.Alerts are based on searches and require cron to run on scheduled interval

D.Alerts are based on searches that are run exclusively as real-time

A.limits, countfield

B.limit, count

C.limit, showpercent

D.shovperc, countfield

A.fail*

B.*fail

C.f*il

D.*fail*