A.chart sales by product_name

B.chart sum(price) as sales by product_name

C.stats sum(price) as sales over product_name

D.timechart list(sales), values(product_name)

A.The Field Extractor uses PERL to extract fields from the raw events.

B.The Field Extractor automatically extracts all fields at search time.

C.Fields extracted using the Field Extractor persist as knowledge objects.

D.Fields extracted using the Field Extractor do not persist and must be defined for each search.

A.Use the scats command when you next to group events by two or more fields.

B.The stats command is faster and more efficient than the transaction command

C.The transaction command is faster and more efficient than the stats command.

D.Use the transaction command when you want to see the results of a calculation.

A.ASCIE

B.Chronological

C.Reverser chronological

D.Alphabetical

A.index=web status=50* | chart count over host, status

B.index=web status=50* | chart count by host, status

C.index=web status=50* | chart count over host by status