A customer has written the following search: How can the search be rewritten to maximize efficiency? A. B. C. D.

Question

Exhibits

Options

• Aindex=sales sourcetype=purchase:orders | table _time, customer, product, amount, order_id | stats count sum(amount) AS amount latest (_time) AS _time by customer, order_id | search customer = "timmy*" | lookup vip_customers customer OUTPUT vip_status | table _time, customer, order_id, amount, vip_status | search vip_status="true"
• Bindex=sales sourcetype=proxydata:syslog user="timmy*" | table _time, user, url, duration, category, action | stats sum(duration) AS duration latest(url) AS url latest (_time) AS _time by user | lookup user_status user OUTPUT user | table _time, user, status
• Cindex=sales sourcetype=purchase:orders customer="timmy*" | lookup vip_customers customer OUTPUT vip_status | search vip_status = "true" | stats sum(amount) AS amount latest (_time) AS _time by customer, order_id | table _time, customer, order_id, amount
• Dindex=sales sourcetype=purchase:orders customer="timmy*" | lookup vip_customers customer OUTPUT vip_status | stats sum(amount) AS amount latest (_time) AS _time by customer, order_id | search vip_status="true" | table _time, customer, order_id, amount, vip_status

• A
  13% (3)
• B
  17% (4)
• C
  67% (16)
• D
  4% (1)

Explanation

You've hit your limit · resets 5:20am (America/New_York)

No community discussion yet for this question.