Splunk Core Certified Power User — Question 54

A user wants to create a new field alias for a field that appears in two sourcetypes.
How many field aliases need to be created?

Answer options

• A. One.
• B. Two.
• C. It depends on whether the original fields have the same name.
• D. It depends on whether the two sourcetypes are associated with the same index.

Correct answer: B

Explanation

Two field aliases need to be created because each sourcetype requires its own alias for the field, even if they refer to the same underlying data. Option A is incorrect as it underestimates the number of aliases needed, while options C and D introduce irrelevant conditions that do not affect the requirement for field aliases.