Splunk splk 1002 test w Study guides, Class notes & Summaries

Which of the following knowledge objects represents the output of an eval expression? A. Eval fields B. Calculated fields C. Field extractions D. Calculated lookups - Answer B. Calculated fields What do events in a transaction have in common? A. All events in a transaction must have the same timestamp. B. All events in a transaction must have the same sourcetype. C. All events in a transaction must have the exact same set of fields. D. All events in a transaction must be related by one ...