List of questions
Related questions
Question 158 - SPLK-1002 discussion
Which of the following searches show a valid use of a macro? (Choose all that apply.)
A.
index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
B.
index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
C.
index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
D.
index=main source=mySource oldField=* | ''newField('makeMyField(oldField)')'' | table _time newField
Your answer:
0 comments
Sorted by
Leave a comment first