問題文
An analyst wants events from any source type whose name begins with a shared prefix and is unsure whether the environment uses the common or the combined variant of that name. Which approach fits?
選択肢
- List both names separated by a space, so that either of them satisfies the search.
- Omit the source type entirely and rely on the fields sidebar to list the values, because a search cannot use a partial field value.
- Use a wildcard at the end of the value, so that any source type starting with that prefix matches.
- Put the wildcard at the start of the value, because a leading wildcard is resolved from the index and is therefore faster than a trailing one.