What are the two parts of a root event dataset?

What are the two parts of a root event dataset?
A . Fields and variables.
B . Fields and attributes.
C . Constraints and fields.
D . Constraints and lookups.

View Answer

Answer: C

Explanation:

Reference: https://docs.splunk.com/Documentation/SplunkLight/7.3.5/GettingStarted/Designdatamodelobjects

A root event dataset is the base dataset for a data model that defines the source or sources of the data and the constraints and fields that apply to the data1. A root event dataset has two parts: constraints and fields1. Constraints are filters that limit the data to a specific index, source, sourcetype, host or search string1. Fields are the attributes that describe the data and can be extracted, calculated or looked up1. Therefore, option C is correct, while options A, B and D are incorrect.