Splunk Core Certified Power User — Question 105

If a calculated field has the same name as an extracted field, what happens to the extracted field?

Answer options

• A. The calculated field will override the extracted field.
• B. The calculated and extracted fields will be combined.
• C. The calculated field will duplicate the extracted field.
• D. An error will be returned and the search will fail.

Correct answer: A

Explanation

The correct answer is A because when a calculated field is created with the same name as an existing extracted field, it takes precedence and effectively replaces the extracted field. Options B and C are incorrect as they suggest that both fields can coexist or be duplicated, which is not the case. Option D is also wrong as no error is generated; the calculated field simply overrides the extracted one.