The questions ask for "How many field aliases need to be created?"
Therefore, only one aliases needed to be created, using the two field.
answer should be A, one.
Answer is A, you just need one, even if there are 2 sourcetypes, thats the idea of tags that we can resume similar fields from different field even default field (host, source, sourcetype). Check F2 page 181-182
New field alias required for each sourcetype (184)
upvoted 2 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
IGoddard90
Highly Voted 3 years, 9 months agoNastyNutsu
Most Recent 2 weeks, 5 days agoDree_Dogg
1 year, 4 months agoarcsw
2 years, 1 month agoRayObbes
2 years, 8 months agoSasnycoN
3 years, 1 month agojman92
3 years, 3 months agoBengieQuesada
3 years, 4 months agoninya69
3 years, 2 months agoHudda
3 years, 5 months agoRobo187
3 years, 9 months ago