Its B .
EVAL-<fieldname> = <eval statement>
* Use this to automatically run the <eval statement> and assign the value of
the output to <fieldname>. This creates a "calculated field."
* When multiple EVAL-* statements are specified, they behave as if they are
* run in parallel, rather than in any particular sequence.
For example say you have two statements: EVAL-x = y*2 and EVAL-y=100. In
this case, "x" is assigned the original value of "y * 2," not the
value of "y" after it is set to 100.
* Splunk software processes calculated fields after field extraction and
field aliasing but before lookups. This means that:
* You can use a field alias in the eval statement for a calculated
field.
* You cannot use a field added through a lookup in an eval statement for a
calculated field.
* No default.
Well, even though in the PDF says that "Can apply field aliases to lookups" in page 181, in here [1] says "Splunk software applies field aliases to a search after it performs key-value field extraction, but before it processes calculated fields, lookups, event types, and tags.
This means that you can create aliases for fields that are extracted at index time or search time, but you cannot create aliases for calculated fields, event types, tags, or fields that are added to your events by a lookup."
[1] https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/Addaliasestofields
So, I go for C in this case, as it makes more sense to me for the order of execution of the operations, first aliases then lookups.
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence
Yes your statement is absolutely correct. But take a moment to think on it. That says that you can create Lookups based on Aliases because Aliases are created first at searchtime. But you cannot Create aliases out of results of a lookup what is meant in "fields that are added to your events by a lookup" . So answer is B.
upvoted 3 times
...
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
oksey
Highly Voted 4 years, 3 months agoGlat
4 years ago8b5c1e8
1 month agoS_E_A_N
Most Recent 2 weeks, 5 days agoDilaniI
3 weeks, 6 days agoqawasmih
4 months, 2 weeks agoHarrysa
1 year, 8 months agomarda
2 years, 10 months agoComeUp
2 years, 11 months agoComeUp
2 years, 11 months agogcalcaterra
4 years agogcalcaterra
4 years agosome_thing
3 years, 6 months agoSpTester
3 years, 11 months ago