Which of the following would be a valid post-processing search?

There is a global search named “global_search” defined on a form as shown below:

<search id=“global_search”>

<query>

index-_internal source-*splunkd.log | stats count by component, log_level

</query>

</search>

Which of the following would be a valid post-processing search? (Select all that apply.)
A . | tstats count
B . sourcetype=mysourcetype
C . stats sum(count) AS count by log level
D . search log_level=error | stats sum(count) AS count by component

View Answer

Answer: CD

Explanation:

Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/Savedsearches