問題文
A search returns a line below the search bar reading that 12,431 events were matched. A colleague asks whether that number is the number of rows the analyst will report. What is the correct answer?
選択肢
- No: the matched count is an estimate that the platform refines only after the search job has been finalized.
- No. It is the count of events that matched the search criteria, and any later command in the pipeline can change how many rows are finally produced.
- Yes, provided the analyst has not changed the search mode, given that the mode determines how many of the matched events are returned.
- Yes. The matched count and the number of reported rows are always the same, since each matched event becomes exactly one row in the output.