nerdexam
Splunk

SPLK-1002 · Question #201

If a calculated field has the same name as an extracted field, what happens to the extracted field?

The correct answer is A. The calculated field will override the extracted field. When you define a calculated field, you can specify the name of the field that the eval expression will create or modify. If the name of the calculated field matches the name of an existing extracted field, the calculated field will override the extracted field and replace its…

Creating Field Aliases and Calculated Fields

Question

If a calculated field has the same name as an extracted field, what happens to the extracted field?

Options

  • AThe calculated field will override the extracted field.
  • BThe calculated and extracted fields will be combined.
  • CThe calculated field will duplicate the extracted field.
  • DAn error will be returned and the search will fail.

How the community answered

(66 responses)
  • A
    92% (61)
  • B
    2% (1)
  • C
    2% (1)
  • D
    5% (3)

Explanation

When you define a calculated field, you can specify the name of the field that the eval expression will create or modify. If the name of the calculated field matches the name of an existing extracted field, the calculated field will override the extracted field and replace its value with the result of the eval expression. This means that the original value of the extracted field will not be available for searching or analysis. To avoid this, you should use a unique name for your calculated field or use a different name for your extracted field.

Topics

#Calculated Fields#Field Precedence#Extracted Fields#Field Overriding

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice