Splunk Core Certified Power User — Question 101

Which knowledge object is used to normalize field names to comply with the Splunk Common Information Model (CIM)?

Answer options

• A. Event types
• B. Tags
• C. Field alias
• D. Search workflow action

Correct answer: C

Explanation

The correct answer is C, as field aliases are specifically designed to map existing field names to new names that conform to the CIM standards. Options A, B, and D do not serve this purpose; event types categorize events, tags provide metadata, and search workflow actions facilitate user interactions, but none normalize field names.