Splunk
SPLK-1002 · Question #105
Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize dat
The correct answer is B. Macros. Normalize your data for each of these fields using a combination of field aliases, field extractions,
Using the Common Information Model Add-On
Question
Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize dat
Options
- Ain addition to field aliases, event types, and tags?
- BMacros
- CLookups
- DWorkflow actions
- EField extractions
How the community answered
(53 responses)- B92% (49)
- C2% (1)
- D4% (2)
- E2% (1)
Explanation
Normalize your data for each of these fields using a combination of field aliases, field extractions,
Topics
#Splunk CIM#Knowledge Objects#Data Normalization#Macros
Community Discussion
No community discussion yet for this question.