Which of the following statements describes field aliases?

Which of the following statements describes field aliases?
A . Field alias names replace the original field name.
B . Field aliases can be used in lookup file definitions.
C . Field aliases only normalize data across sources and sourcetypes.
D . Field alias names are not case sensitive when used as part of a search.

View Answer

Answer: B

Explanation:

Field aliases are alternative names for fields in Splunk. Field aliases can be used to normalize data across different sources and sourcetypes that have different field names for the same concept. For example, you can create a field alias for src_ip that maps to clientip, source_address, or any other field name that represents the source IP address in different sourcetypes. Field aliases can also be used in lookup file definitions to map fields in your data to fields in the lookup file. For example, you can use a field alias for src_ip to map it to ip_address in a lookup file that contains geolocation information for IP addresses. Field alias names do not replace the original field name, but rather create a copy of the field with a different name. Field alias names are case sensitive when used as part of a search, meaning that src_ip and SRC_IP are different fields.