Calculated fields can be based on which of the following?
Calculated fields can be based on which of the following?
Calculated fields can be based on fields generated from a search string because Splunk allows users to utilize various field types generated within the search process in their calculations. This includes extracted fields, lookup fields, and other fields created during the search. While extracted fields may be commonly used, it is not exclusively required, and the fields used can be broader, including those created dynamically within a search context.
B Pg. 188 of the PDF
"MUST be based on an extracted field", which makes B wrong
Yeah but no other answer makes sense, so probably the wording in the question is wrong and should must instead of can
It's B "Calculated fields can reference all types of field extractions and field aliasing, but they cannot reference lookups, event types, or tags."
In Splunk, calculated fields can use extracted fields in their calculations, but it is not a requirement. Calculated fields can perform calculations with the values of two or more fields already present in those events. These fields can be extracted fields or any other field present in the event data. So, to answer your question, calculated fields can use extracted fields in their calculations, but it is not a must.
"D" is possible, but B is the best answer. "Calculated fields can reference all types of field extractions and field aliasing, but they cannot reference lookups, event types, or tags."
It's B.
Answer B means that you can't make calculated fields based on lookup fields, but that is not true. Answer is D - you can make calculated fields on fields generated by search string, including extracted fields, lookup fields and other calculated fields
B. From page 188 note, "Output fields from a lookup table or fields/columns generated from within a search string are not supported".
B is correct