Splunk Infrastructure Overview — Question 47
Which commands should be used in place of a subsearch if possible?
Answer options
- A. untable and/or xyseries
- B. stats and/or eval
- C. mvexpand and/or where
- D. bin and/or where
Correct answer: B
Explanation
The correct answer is B, as the 'stats' and 'eval' commands are designed to perform data aggregation and evaluation directly, which can often replace the need for a subsearch. The other options, while useful in their own right, do not provide the same functionality for replacing subsearches.