A.A name of the workflow action

B.A URI where the user will be directed at search time.

C.A label that will appear in the Event Action menu at search time.

D.A name for the URI where the user will be directed at search time.

A.Amount of data fetched from index matching that time range

B.Time range for the static results

C.Amount of data shown on the timeline as data streams in

A.None of these searches would generate a similart graph.

B.index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | start count states

C.index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | timechart count by status

D.index_internal seourcetype=Savesplunker | fields sourcetype, status | transaction status maxspan-id | chart count states by -time

A.A macro is a reusable search string that must contain the full search.

B.A macro is a reusable search string that must have a fixed time range.

C.A macro is a reusable search string that may have a flexible time range.

D.A macro is a reusable search string that must contain only a portion of the search.

A.statscan only group events using IP addresses.

B.The transactioncommand is faster and more efficient.

C.There is a 1000 event limitation with the transactioncommand.

D.Use statswhen the events need to be viewed as a single correlated event.