Splunk
SPLK-3001 · Question #84
What should be used to map a non-standard field name to a CIM field name?
The correct answer is A. Field alias. You use a field alias to alias an existing field to a CIM compliant field, thus making the non- compliant field, compliant via proxy.
Custom Add-ons
Question
What should be used to map a non-standard field name to a CIM field name?
Options
- AField alias.
- BSearch time extraction.
- CTag.
- DEventtype.
How the community answered
(42 responses)- A93% (39)
- B2% (1)
- C5% (2)
Explanation
You use a field alias to alias an existing field to a CIM compliant field, thus making the non- compliant field, compliant via proxy.
Topics
#CIM field mapping#field alias#data normalization#add-on configuration
Community Discussion
No community discussion yet for this question.