When searching in Splunk, which of the following SPL commands can be used to run a subsearch across every field in a wildcard field list?

After discovering some events that were missed in an initial investigation, an analyst determines this is because some events have an empty src field. Instead, the required data is often captured in another field called machine_name.
What SPL could they use to find all relevant events across either field until the field extraction is fixed?

What is the term for a model of normal network activity used to detect deviations?

According to Splunk CIM documentation, which field in the Authentication Data Model represents the user who initiated a privilege escalation?

Why is tstats more efficient than stats for large datasets?