When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName

When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName
A . The text of the query
B. The results of the Statistics tab
C. No data Results can only be exported when the "table" command is used
D. All events in the Events tab

View Answer

Answer: B

Explanation:

When exporting the results of an event search, the data that is saved in the exported file depends on the mode and the tab that is selected. In this case, the mode is Verbose and the tab is Statistics, as indicated by the stats command. Therefore, the data that is saved in the exported file is the results of the Statistics tab, which shows the count of events by ComputerName. The text of the query, all events in the Events tab, and no data are not correct answers.

Reference: https://docs.splunk.com/Documentation/Splunk/8.2.3/Search/Exportsearchresults