What is the correct syntax to count the number of events containing a vendor_action field?
By default, which of the following fields would be listed in the fields sidebar under interesting Fields?
Therefore, among the four options, only sourcetype would be listed in the fields sidebar under interesting fields by default.
Reference
When looking at a dashboard panel that is based on a report, which of the following is true?