A. False

B. True

A. Splunk will re-run the search job in Verbose Mode to prioritize the new Selected Field.

B. Splunk will highlight related fields as a suggestion to add them to the Selected Fields list.

C. Custom selections will replace the Interesting Fields that Splunk populated into the list at search time.

D. The selected field and its corresponding values will appear underneath the events in the search results.

A. index

B. action

C. clientip

D. sourcetype

A. Lookups can be time based

B. Search results can be used to populate a lookup table

C. Lookup have a 10mg maximum size limit

D. Splunk DB Connect can be used to populate a lookup table from relational databases

E. Output from a script can be used to populate a lookup table

A. All data accessible to all users will appear in the report until the next time the report is run.

B. All data accessible to the User role will appear in the report.

C. All data accessible to the owner of the report will appear in the report.

D. The owner of the report can configure permissions so that the report uses either the User role or the owner's profile at run time.