フリー問題

問題文

A search aggregates events into a table and then, further to the right, tries to display the raw text of the individual events. What happens?

選択肢

1. The raw text is displayed for the first row only, because the aggregation retains one representative event per group in case a later command needs it.
2. The raw text is displayed, because the platform keeps the original events alongside the table so that later commands can reach either representation.
3. The search fails with a syntax error, because a command that refers to event text cannot appear anywhere after a command that aggregates.
4. The raw text is not available, because the aggregation replaced the events with a result table and the later command has only that table to work with.