Well, even though in the PDF says that "Can apply field aliases to lookups" in page 181, in here [1] says "Splunk software applies field aliases to a search after it performs key-value field extraction, but before it processes calculated fields, lookups, event types, and tags.
This means that you can create aliases for fields that are extracted at index time or search time, but you cannot create aliases for calculated fields, event types, tags, or fields that are added to your events by a lookup."
[1] https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/Addaliasestofields
So, I go for C in this case, as it makes more sense to me for the order of execution of the operations, first aliases then lookups.
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence
Yes your statement is absolutely correct. But take a moment to think on it. That says that you can create Lookups based on Aliases because Aliases are created first at searchtime. But you cannot Create aliases out of results of a lookup what is meant in "fields that are added to your events by a lookup" . So answer is B.
upvoted 3 times
...
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
oksey
Highly Voted 4 years, 2 months agoGlat
3 years, 11 months ago8b5c1e8
2 days, 21 hours agoqawasmih
Most Recent 3 months, 2 weeks agoHarrysa
1 year, 7 months agomarda
2 years, 9 months agoComeUp
2 years, 10 months agoComeUp
2 years, 10 months agogcalcaterra
3 years, 11 months agogcalcaterra
3 years, 11 months agosome_thing
3 years, 5 months agoSpTester
3 years, 10 months ago