Splunk Core Certified Power User — Question 34

Calculated fields can be based on which of the following?

Answer options

• A. Tags
• B. Extracted fields
• C. Output fields for a lookup
• D. Fields generated from a search string

Correct answer: B

Explanation

The correct answer is B because calculated fields are specifically derived from extracted fields that have been parsed from the raw data. Options A, C, and D do not serve as bases for calculated fields in the same way that extracted fields do.