C. Calculated fields, lookups, event types, and tags.
From result , which discusses the sequence of search-time operations:
"These knowledge objects include extracted fields, calculated fields, lookup fields, field aliases, tags, and event types."
Result mentions that field aliases can be used before field lookups:
"Perform field aliasing after key-value extraction but before field lookups so that you can specify a lookup table based on a field alias."
Result states that tags can be applied to any field/value pair, including those added through other methods:
"You can apply tags to any field/value pair in an event, whether it is extracted at index time, search time, or added through some other method, such as an event type, lookup, or calculated field."
Calculated fields can reference field aliases, as they come after field aliasing in the search-time operations sequence.
Event types, being a higher-level abstraction, can also reference field aliases.
Field Extracted > Alias > Calculated Field > Lookup > Event Type > Tag
upvoted 1 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
NastyNutsu
2 weeks, 5 days agofreeolive_guru
4 months, 1 week agoAsheel1
10 months, 2 weeks agoAlexi2415
10 months, 2 weeks ago