Which command would be the appropriate choice?

You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc.

Which command would be the appropriate choice?
A . fields
B. distinct count
C. table
D. values

View Answer

Answer: C

Explanation:

The table command is used to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. It takes one or more field names as arguments and displays them in a tabular format. The fields command is used to keep or remove fields from search results, not to display them in a list. The distinct_count command is used to count the number of distinct values of a field, not to display them in a list. The values command is used to display a list of unique values of a field within each group, not to display all event occurrences.

Reference: https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Table