Exam SPLK-1002 topic 1 question 35 discussion

Lookup is wrong - Field Extraction shld be correct

Reference: Fund 2 - P.268: Leverage CIM when creating field extractions, field aliases, event types and tags ... D is the best-fit in the answer set here.

"Normalize your data for each of these fields using a combination of field aliases, field extractions, and lookups." from https://docs.splunk.com/Documentation/CIM/4.6.0/User/UsetheCIMtonormalizedataatsearchtime

Answer is D pg 267 F2 Leverage the CIM when creating Field Extractions, Field Aliases, Event Types and Tags. there is no reason for any answers here to be wrong. there's documentation lol. and the actual PDF that can be found on the internet.

B & D https://docs.splunk.com/Documentation/CIM/4.6.0/User/UsetheCIMtonormalizedataatsearchtime

B, D https://docs.splunk.com/Documentation/CIM/5.3.1/User/UsetheCIMtonormalizedataatsearchtime

BD is the correct options. Link to the latest docs: https://docs.splunk.com/Documentation/CIM/5.3.1/User/UsetheCIMtonormalizedataatsearchtime

It's B&D. See splunk doc here: https://docs.splunk.com/Documentation/CIM/4.6.0/User/UsetheCIMtonormalizedataatsearchtime

Does this question ask for multiple options? It doesn't say "Choose all that apply" as in the others. If it needs only one, I'd definitely go for D. Field Extraction. If I can choose more than one, I'd go with B and D.

B is the answer

B&D: "field aliases, field extractions, and lookups."

The Answer is D. It can not be B because - Sure. Lookups are used to map values from one field to another. They cannot be used to normalize data by extracting the same data from different events and storing it in the same field. For example, a lookup could be used to map the value "John Doe" from the user_name field to the full_name field. This would not normalize the data, as the user_name and full_name fields would still contain different data. Lookups can be used to normalize data in some cases, but they are not the only knowledge object that can be used for this purpose. Field extractions are a more powerful tool for normalizing data, as they can be used to extract data from events and store it in fields.

If a user wants to convert numeric field values to strings and then sort on those values, they should use the eval command first and then the sort command. The eval command is used to add a new field to the search results that contains the string representation of the numeric field. For example, the following eval command converts the count field to a string: | eval count_str=tostring(count)

Lookups : Fund 2 PG .277

B and D. https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime In the above link- Under point 5a. Normalize your data for each of these fields using a combination of field aliases, field extractions, and lookups.

B - Lookups are a knowledge object; field extractions aren’t

B is the correct answer