C. Calculated fields, lookups, event types, and tags.
From result , which discusses the sequence of search-time operations:
"These knowledge objects include extracted fields, calculated fields, lookup fields, field aliases, tags, and event types."
Result mentions that field aliases can be used before field lookups:
"Perform field aliasing after key-value extraction but before field lookups so that you can specify a lookup table based on a field alias."
Result states that tags can be applied to any field/value pair, including those added through other methods:
"You can apply tags to any field/value pair in an event, whether it is extracted at index time, search time, or added through some other method, such as an event type, lookup, or calculated field."
Calculated fields can reference field aliases, as they come after field aliasing in the search-time operations sequence.
Event types, being a higher-level abstraction, can also reference field aliases.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
NastyNutsu
4 months, 3 weeks agofreeolive_guru
8 months, 2 weeks agoAsheel1
1 year, 2 months agoAlexi2415
1 year, 2 months ago