When a search is executed, what must occur before field aliases can be assigned?
A.
Perform lookups
B.
Process calculated fields
C.
Create event types
D.
Extract fields
The Answer Is:
D
This question includes an explanation.
Explanation:
Field aliases can only be applied after fields have been extracted .
Extract:“Field extraction occurs before field aliasing in the search-time data processing order. Field aliases depend on extracted field names to function.”
Thus, fields must first be extracted before any alias can be assigned.
SPLK-1002 PDF/Engine
Printable Format
Value of Money
100% Pass Assurance
Verified Answers
Researched by Industry Experts
Based on Real Exams Scenarios
100% Real Questions
Get 65% Discount on All Products,
Use Coupon: "ac4s65"