A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?
A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?
A field alias must be created for each sourcetype if the user wants to create a new field alias for a field that appears in two sourcetypes. This is because field aliases are applied per sourcetype, and therefore, two separate aliases are needed to cover both sourcetypes.
Answer is B, Two. One alias for each sourcetype
Answer is A, you just need one, even if there are 2 sourcetypes, thats the idea of tags that we can resume similar fields from different field even default field (host, source, sourcetype). Check F2 page 181-182
Page 184 explains that you have to create new field alias for each sourcetype. So B is answer
B, a new alias is required for a new sourcetype
Page 184 explains that you have to create new field alias for each sourcetype. So B is answer
New field alias required for each sourcetype (184)
could you pls confirm the final answer friends?
The answer is two, so B. One alias for each sourcetype.
B, try it yourself
an alias for each sourcetype. so that would be 2. the answer is B