A. index=security Error Fail

B. index=security error OR fail

C. index=security "error failure"

D. index=security NOT error NOT fail

A. Your search must transform event data into XML formatted data first.

B. Your search must transform event data into statistical data tables first.

C. Your search must transform event data into JSON formatted data first.

D. Your search must transform event data into Excel file format first.

A. Will display result depending on the data.

B. Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.

C. Will return event where status field exist but value of that field is not 100.

A. index=security "failed password"

B. (index=* OR index=security) "failed password"

C. index=* "failed password"

D. "failed password" index=*

A. earliest=-2hour@d

B. earliest=-2h

C. latest=-2h

D. latest=-2hour@d