Question 1

Which of the following is true about the preview feature and macros?

Options :

A : The preview feature expands only the selected macro within the search.

B : The preview feature can be launched using Tab-Shift-E on Mac or Windows.

C : The preview feature can be launched by right-clicking on the macro name in the search string.

D : The preview feature expands all macros within the search, including nested macros.

Answer: D

Question 2

Which of the following can be used to access external lookups?

Options :

A : Perl and Python

B : Python and Ruby

C : Perl and binary executable

D : Python and binary executable

Answer: D

Question 3

Where can wildcards be used in the tstats command?

Options :

A : No wildcards can be used with

B : In the where to clause.

C : In the from clause.

D : In the by clause.

Answer: C

Question 4

Which of the following cannot be accomplished with a webhook alert action?

Options :

A : Retrieve data from a web page

B : Create a ticket in a support app

C : Post a notification on a web page

D : Post a message in a chatroom

Answer: A

Question 5

What does using the tstats command with summariesonly=false do?

Options :

A : Returns results from only non-summarized data.

B : Returns results from both summarized and non-summarized data.

C : Prevents use of wildcard characters in aggregate functions.

D : Returns no results.

Answer: B