フリー問題

問題文

Two host names in the data refer to the same physical computer. The team wants one search term that returns the events from both. Which approach does the documentation describe?

選択肢

1. Create an alias so that one host name becomes the second name of the other, then search for either.
2. Give both host values the same tag, then search for that tag so that events involving both names are returned.
3. Create a calculated field that maps one host name onto the other, so both resolve to a single value.
4. Create two event types, one for each host name, and search for both of them with an alternation.