A.The extraction is added at index time.

B.There is a limit to the number of fields that can be extracted.

C.The user is unable to return to the automatic field extraction workflow.

D.The user is unable to preview the extractions.

A.state can only group events using IP addresses.

B.The transaction command is faster and more efficient.

C.There is a 1000 event limitation with the transaction command.

D.Use state when the events need to be viewed as a single event.

A.index=main REJECT | transaction sessionid

B.index=main | transaction sessionid | search REJECT

C.index=main | transaction sessionid | where transaction=reject

D.index=main | transaction sessionid | where transaction="REJECT*"

A.1, 2, 3

B.2, 3, 1

C.3, 2, 1

D.2, 1, 3

A.''hex''

B.''commas''

C.''Decimal''

D.''duration''