フリー問題

問題文

A search must keep only the events where the value in the field holding the observed address equals the value in the field holding the address recorded by the proxy. The two field names are different. Which command performs this comparison?

選択肢

1. The dedup command with both the observed address field and the proxy address field names listed.
2. The fillnull command with both field names listed, because it aligns the two fields before the comparison happens.
3. The search command, because both fields exist in the events and search can place them on either side of the equals sign.
4. The where command, because it treats an unquoted token as a field name and can therefore compare one field against another.