SPLK-1002 · Question #127
A user wants to create a new field alias for a field that appears in two sourcetypes. How many field aliases need to be created?
The correct answer is B. Two. Field aliases in Splunk are scoped to a specific sourcetype, so one alias must be created per sourcetype where the field appears.
Question
A user wants to create a new field alias for a field that appears in two sourcetypes. How many field aliases need to be created?
Options
- AOne.
- BTwo.
- CIt depends on whether the original fields have the same name.
- DIt depends on whether the two sourcetypes are associated with the same index.
How the community answered
(26 responses)- A4% (1)
- B88% (23)
- D8% (2)
Why each option
Field aliases in Splunk are scoped to a specific sourcetype, so one alias must be created per sourcetype where the field appears.
A single alias cannot span multiple sourcetypes; it is always scoped to the one sourcetype it is configured for.
In Splunk, field aliases are defined per sourcetype in props.conf. Because each sourcetype is treated as an independent configuration context, you must create one alias for each sourcetype where the field exists - resulting in exactly two aliases when the field appears in two sourcetypes.
Whether the original fields share the same name is irrelevant; the determining factor is the number of sourcetypes involved, not field name similarity.
The index a sourcetype is associated with has no bearing on field alias creation; aliases are scoped to sourcetypes, not indexes.
Concept tested: Splunk field alias configuration scoped per sourcetype
Source: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addaliasestofields
Topics
Community Discussion
No community discussion yet for this question.