Exam SPLK-1002 topic 1 question 159 discussion

Option C is more correct: Explanation: In Splunk, if an event has values for only one field (like field1) and not for another field (like field2), then the values of field2 remain unchanged in the context of that particular event. Field2 will still retain whatever values it has from previous events or selections if it is present. Here’s a breakdown of the other options for clarification: A. field1 and field2 values are merged.: This is incorrect. There is no merging of values; each field retains its own values independently. B. field2 values are removed from the events.: This is incorrect. Values for field2 are not removed; they simply are not present in this specific event. D. field2 values are replaced with the value of field1.: This is incorrect. Values in field2 are not replaced by any value from field1 unless specifically programmed to do so with a command.

Select Overwrite field values if you want your field alias to remove the field alias name when the original field does not exist or has no value, or replace the field alias name with the original field name when the field alias name already exists. REF: https://kinneygroup.com/blog/splunk-fields-of-dreams-how-to-create-calculated-fields-and-aliases/#:~:text=(Optional)%20Select%20Overwrite%20field%20values,Click%20Save.