Splunk Core Certified Power User — Question 63

A calculated field may be based on which of the following?

Answer options

• A. Lookup tables
• B. Extracted fields
• C. Regular expressions
• D. Fields generated within a search string

Correct answer: B

Explanation

The correct answer is B, as calculated fields are specifically derived from extracted fields, which are processed data fields from your data source. The other options, such as lookup tables, regular expressions, and fields generated within a search string, do not directly create calculated fields.