A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode.
Which field name appears in the results?
A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode.
Which field name appears in the results?
When a search is executed in Smart Mode and an alias for a field is present, both the original field and its alias will appear in the Interesting Fields list, provided they appear in at least 20% of the events. This ensures that users can see the most relevant fields without having to specify them in the search explicitly.
I think B is the Ans
See p186 of F2
B is true
B is the correct answer
Why A is incorrect ?
Because you don't necessarily need to specify the alias in the search. If it appears in at least 20% of events, it will appear in the interesting fields even if you didn't specify it in the search. A would be correct only in case of "Fast Mode" enabled.
Correct!..
B is the correct answer