Exam SPLK-1002 topic 1 question 110 discussion

All you need is to remember this: FACLET Field extracted > Alias > Calculated Field > Lookup > Event Type > Tags Then remember that you can only use what is referenced prior to you. So Tags can reference everything, but lookup only field extracted, alias and calculated fields

The answer is A. Per Splunk, "Calculated fields can reference all types of field extractions as well as field aliases. They cannot reference lookups, event types, or tags."https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Searchtimeoperationssequence#Calculated_fields

Field Extractions > Field Aliases > Calculated Fields > Lookups > Event Types > Tags if B is Field Extraction, Then A and B is the answer but because of "lookup" contain in B, make B incorrect. Therefore, the answer is A

The correct answer is B. A field added by an automatic lookup. A calculated field is a field that is added to events at search time by using an eval expression. A calculated field can use the values of two or more fields that are already present in the events to perform calculations.A calculated field can use any field as a source, as long as the field is extracted before the calculated field is defined1. An automatic lookup is a way to enrich events with additional fields from an external source, such as a CSV file or a database.An automatic lookup can add fields to eventsbased on the values ofexisting fields, such as host, source, sourcetype, or any other extracted field2.An automatic lookup is performed before the calculated fields are defined, so the fields added by the lookup can be used as sources for the calculated fields3. Therefore, a calculated field can use a field added by an automatic lookup as a source.

i have scheduled the exam, got confused community vote answers & examtopics answers. examtopics team please explain how it is different from vote answers?

Answer A is correct: https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Searchtimeoperationssequence

Answer is A

poubelleIc66 and n00r1 said it better than I ever could. :-)

A: Explanation from poubelleIc66 and n00r1!!

A calculated field can use any field in the data source as a source, including fields that are added by an automatic lookup. This is because the automatic lookup is performed before the calculated field is evaluated. The other options are incorrect because: An alias of a field is not a separate field, so it cannot be used as a source. The tag field and the eventtype field are both system fields, which cannot be used as sources.

Ans is A because the search time operation sequence. https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Searchtimeoperationssequence

Why not B also? A field added by an automatic lookup can be used as a source for a calculated field. When a lookup is configured to automatically add fields to events based on a lookup table, the added fields can be used in calculations just like any other field. For example, suppose you have a lookup table that maps user IDs to department names. When you perform a search and the lookup table is applied, a new field called "department" is automatically added to each event, based on the user ID in the event. You can then use this "department" field as a source for a calculated field, such as counting the number of events by department. Therefore, B is the correct answer.

A is a better answer