A.timestamp

B.time

C._time

D.EventTime

A.Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

B.Will get different results depending on data

C.Will return event where status field exist but value of that field is not 100.

A.No

B.Yes

A.count, sum, less

B.sum, values, table

C.sum, avg, values

D.count, sum, add

A.error | table column=action column=src column=dest

B.error | table action, src, dest

C.error | tabular action, src, dest

D.error | stats table action, src, dest