Which of the following knowledge objects can reference field aliases?

Question

Options

• ACalculated fields, lookups, event types, and tags.
• BCalculated fields and tags only.
• CCalculated fields and event types only.
• DCalculated fields, lookups, event types, and extracted fields.

• A
  92% (34)
• B
  5% (2)
• C
  3% (1)

Explanation

Splunk applies knowledge objects in a specific layered order. Field aliases are applied before calculated fields, lookups, event types, and tags - meaning all four of those knowledge objects can reference an aliased field name as if it were the original field name. Calculated fields can use aliased field names in their eval expressions; lookups can join on aliased fields; event types can match on aliased fields; and tags can be assigned to values of aliased fields. Extracted fields, however, operate at a lower layer (before aliases), so they cannot reference aliases.

No community discussion yet for this question.