transforming commands correct answers order search results into a data table for statistical
purposes
Top Command correct answers Finds the most common values of a given field
Rare Command correct answers Shows the least common values of a field set
Common stats functions correct answers count
distinct count (dc)
sum
average
min
max
list
values
Count function correct answers returns a count of events matching search criteria
distinct count function (dc) correct answers returns the count of unique values in the search
results
sum function correct answers returns the sum of all numerical values in a field
Average (avg) function correct answers creates an average value for a given field
min/max functions correct answers return the minimum and maximum values for fields
List function correct answers Lists all values for a given field
Value function correct answers returns unique values for a given field
How many results are shown by default when using a Top or Rare Command? correct answers
10
data models correct answers knowledge objects that provide the data structure that drives Pivots
The instant pivot button is displayed in the statistics and visualization tabs when a _____ search
is run. correct answers non-transforming
Pivots can be saved as dashboard panels correct answers true
knowledge objects that provide the data structure for pivot correct answers data models
two steps to define a lookup table: correct answers define a lookup table
, define the lookup
once defined, lookup field values are ____ by default correct answers case-sensitive
To verify that a lookup is working _____ correct answers pipe to the inputlookup command
Define a lookup correct answers settings
lookup
add new lookup definition
give the lookup a name
select file based
select the .csv file
To keep from overwriting existing fields with your Lookup you can use the ____ clause. correct
answers outputnew
External data used by a Lookup can come from sources like: correct answers scripts
CSV files
Geospatial data
Finish this command so that it displays data from the http_status.csv Lookup file
| ______ http_status.csv correct answers inputlookup
a lookup is categorized as a dataset correct answers true
When using a .csv file for Lookups, the first row in the file represents this. correct answers Field
names
Alerts correct answers based on searches that run on scheduled intervals or in real-time
notify you when the results of a search meet defined conditions
triggered when search is completed
Alerts (functions) correct answers ist in interface
log events
output to lookup
send to a telemetry endpoint
trigger scripts
send emails
use a webhook
run a custom alert
scheduled alert type correct answers allows you to set a schedule and time range for the search to
be run
real-time alert type correct answers will run the search continuously in the background
as soon as alert conditions are satisfied an action is triggered