SPLK-1002: Splunk Core Certified Power User

The fields sidebar is a panel that shows the fields that are present in your search results2.The fields sidebar does not show all extracted fields, which are fields that are extracted from your raw data using various methods such as regular expressions, delimiters or key-value pairs2.The fields sidebar only shows selected fields and interesting fields2.Selected fields are fields that you choose to display in your search results by clicking on them in the fields sidebar or by using the fields command2.Interesting fields are fields that appear in at least 20 percent of events or have high variability among values2. Therefore, option C is correct, while options A and B are incorrect because they are types of fields that the fields sidebar does show.

The timechart command is used to create a time-series chart of statistical values based on your search results2.You can use the timechart command with a by clause to split the results by one or more fields and create multiple series in the chart2.However, you can only list one field after the by clause when using the timechart command because _time is already implied as the x-axis of the chart2. Therefore, option B is correct, while options A, C and D are incorrect.

A root event dataset is the base dataset for a data model that defines the source or sources of the data and the constraints and fields that apply to the data1.A root event dataset has two parts: constraints and fields1.Constraints are filters that limit the data to a specific index, source, sourcetype, host or search string1.Fields are the attributes that describe the data and can be extracted, calculated or looked up1. Therefore, option C is correct, while options A, B and D are incorrect.