Splunk Core Certified Power User — Question 16

A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode.
Which field name appears in the results?

Answer options

• A. Both will appear in the All Fields list, but only if the alias is specified in the search.
• B. Both will appear in the Interesting Fields list, but only if they appear in at least 20 percent of events.
• C. The original field only appears in All Fields list and the alias only appears in the Interesting Fields list.
• D. The alias only appears in the All Fields list and the original field only appears in the Interesting Fields list.

Correct answer: B

Explanation

The correct answer is B because both the original field and the alias will show up in the Interesting Fields list only if they are present in at least 20 percent of the events. The other options are incorrect as they misrepresent how fields are categorized in the search results.