A.Use state when the events need to be viewed as a single event.

B.There is a 1000 event limitation with the transaction command.

C.state can only group events using IP addresses.

D.The transaction command is faster and more efficient.

A.''hex''

B.''commas''

C.''Decimal''

D.''duration''

A.index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time

B.index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status

C.None of these searches would generate a similart graph.

D.index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states

A.True

B.False

A.highlights the field value across the chart

B.drills down for that value

C.adds the highlighted value to the search criteria