Splunk Core Certified Power User SPLK-1002 Question # 91 Topic 10 Discussion
SPLK-1002 Exam Topic 10 Question 91 Discussion:
Question #: 91
Topic #: 10
A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?
A.
Both will appear in the All Fields list, but only if the alias is specified in the search.
B.
Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.
C.
The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.
D.
The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.
A field alias is a way to assign an alternative name to an existing field without changing the original field name or value2. You can use field aliases to make your field names more consistent or descriptive across different sources or sourcetypes2. When you run a search without any transforming commands in Smart Mode, Splunk automatically identifies and displays interesting fields in your results2. Interesting fields are fields that appear in at least 20 percent of events or have high variability among values2. If you have created a field alias based on an original field, both the original field name and the alias name will appear in the Interesting Fields list if they meet these criteria2. However, only one of them will appear in each event depending on which one you have specified in your search string2. Therefore, option B is correct, while options A, C and D are incorrect.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit