What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?

What functionality does the Splunk Common Information Model (CIM) rely on to normalize fields with different names?
A . Macros.
B . Field aliases.
C . The rename command.
D . CIM does not work with different names for the same field.

Answer: B

Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments