フリー問題

問題文

An analyst wants events where the status value is 404 and the request method is POST. Two colleagues propose different searches. One writes: sourcetype=access_combined status=404 method=POST. The other writes: sourcetype=access_combined 404 POST. Which statement about the two searches is correct?

選択肢

1. The second is more precise: omitting the field names lets the search engine use the index more directly.
2. The first fails, given that field names in a search have to be written in uppercase to distinguish them from search terms.
3. The first is more precise, because it requires the values to appear in those specific fields rather than anywhere in the event.
4. The two searches return identical results, because the platform automatically maps bare terms onto the fields in which those values are known to appear.