index=server_485 sourcetype=BETA_726 code=917 | stats where code > 200
C.
index=server_485 sourcetype=BETA_726 code=917
D.
index=server_485 sourcetype=BETA_726 code=917 | stats count by code
The Answer Is:
C
This question includes an explanation.
Explanation:
Event types in Splunk are saved as static search strings. The example index=server_485 sourcetype=BETA_726 code=917 is a simple search that can be saved as an event type, as it does not contain dynamic processing commands like stats or inputlookup, which are not valid for event types.