A. Index

B. Host

C. Sourcetype

D. Source

A. example(2)

B. example(var1,var2)

C. example($,$)

D. example[2]

A. A pipe may always follow a macro.

B. The current user must own the macro.

C. The macro must be defined in the current app.

D. Only when sharing is set to global for the macro.

A. Remove fields from results.

B. Create or replace an existing field.

C. Group transactions by one or more fields.

D. Save SPL commands to be reused in other searches.

A. It behaves exactly like search strings before the first pipe.

B. It can only be used at the beginning of the search pipeline.

C. It does not allow the use of wildcards.

D. It treats field values in a case-sensitive manner.