A. Events that contain the string value where A=B.

B. Events that contain the string value A=B.

C. Events where values of field are equal to values of field B.

D. Events where field A contains the string value B.

A. constantly running in the background

B. A scheduled alert

A. A macro is a reusable search string that must contain the full search.

B. A macro Is a reusable search string that may have a flexible time range.

C. A macro is a reusable search string that must have a fixed time range.

D. A macro Is a reusable search string that must contain only a portion of the search.

A. Root events cannot be accelerated.

B. Accelerated data models cannot be edited.

C. Private data models cannot be accelerated.

D. You must have administrative permissions or the accelerate_datamodelcapability to accelerate a data model.

A. index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField

B. index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField

C. index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField

D. index=main source=mySource oldField=* | "'newField('makeMyField(oldField)')'" | table _time newField