A.Forwarders

B.Deployment Server

C.Indexer

D.Knowledge Objects

E.Index

F.Search Head

A.index=security NOT error NOT fail

B.index=security Error Fail

C.index=security error OR fail

D.index=security "error failure"

A.Splunk automatically discovers many fields based on sourcetype and key/value pairs found in the data.

B.Splunk automatically extracts any fields that generate interesting visualizations.

C.Splunk only extracts the most interesting data from the last 24 hours.

D.Splunk only extracts fields users have manually specified in their data.

A.Look back 3 days ago and prior.

B.Look back 72 hours, up to one day ago.

C.Look back 72 hours, up to the end of today.

D.Look back from 3 days ago, up to the beginning of today.