A.newField
index=main source=mySource oldField=* | stats if('makeMyField(oldField)') |

B.table _time newField
index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'|

C.table _time newField
index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'"

D.| table _time newField

A.chart sales by product_name

B.chart sum(price) as sales by product_name

C.stats sum(price) as sales over product_name

D.timechart list(sales), values(product_name)

A.A macro is a reusable search string that must contain the full search.

B.A macro is a reusable search string that must have a fixed time range.

C.A macro Is a reusable search string that may have a flexible time range.

D.A macro Is a reusable search string that must contain only a portion of the search.

A.There is no limit specific to timechart.

B.because one field would represent the x-axis and the other would represent the y-axis.

C.because _time is already implied as the x-axis.

D.because timechart doesn't support using a by clause.

A.The macro name is sessiontracker and the arguments are $action$, $JESSIONID$.

B.The macro name is sessiontracker(2) and the arguments are action, JESSIONID.

C.The macro name is sessiontracker(2) and the Arguments are $action$, $JESSIONID$.

D.The macro name is sessiontracker and the arguments are action, JESSIONID.