A calculated field may be based on which of the following?

The correct answer is D. Extracted fields. Calculated fields in Splunk are defined using eval expressions and can only be based on already-extracted fields - fields that have been parsed out of the raw event data. They are not based on lookup tables (those are separate knowledge objects), regular expressions (those are us

Creating Field Aliases and Calculated Fields

Question

Options

AFields generated within a search string
BLookup tables
CRegular expressions
DExtracted fields

How the community answered

(24 responses)

B
4% (1)
C
4% (1)
D
92% (22)

Explanation

Calculated fields in Splunk are defined using eval expressions and can only be based on already-extracted fields - fields that have been parsed out of the raw event data. They are not based on lookup tables (those are separate knowledge objects), regular expressions (those are used by field extractions, not calculated fields), or fields generated dynamically within a search string. The calculated field is a persistent, saved eval expression that references one or more extracted fields to derive a new value at search time.

Topics

#Calculated Fields#Field Extraction#Eval Expressions

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice