A. ... | where like (clientip, "108.% )

B. ... | where (clientip, "108. %")

C. ... | where (clientip=108. % )

D. ... | search clientip=108

A. Every event in the network index that does not have a value in this field.

B. Every event in the network index that does not contain a StatusCode of 200 and excluding events that do not have a value in this field.

C. Every event in the network index that does not contain a StatusCode of 200, including events that do not have a value in this field.

D. No results as the syntax is incorrect, the != field expression needs to be used instead of the NOT operator.

A. Data found in a lookup table.

B. Either a calculated field or an extracted field.

C. Only one single field in a dataset.

D. A given host, source, or sourcetype.

A. A macro is a reusable search string that must contain the full search.

B. A macro is a reusable search string that must have a fixed time range.

C. A macro is a reusable search string that may have a flexible time range.

D. A macro is a reusable search string that must contain only a portion of the search.

A. Fast

B. Smart

C. C. Verbose