MENU
Which knowledge Object does the Splunk Common Information Model (CIM) use to normalize dat
a. in addition to field aliases, event types, and tags?
Suggested Answer: B
Get Premium SPLK-1002 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Normalize your data for each of these fields using a combination of field aliases, field extractions, and lookups.
https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime
11 comments · newest first
DA
Dahlia
11 months ago
Macros don't really fit in this context, right?
HU
Huey
11 months ago
Wait, are we sure about that?
DA
Daniel
12 months ago
Totally agree, field extractions are key!
UL
Ulysses
12 months ago
I thought it was lookups?
SU
Susana
12 months ago
It's definitely field extractions!
DE
Deeanna
1 year ago
I'm leaning towards field extractions too, but I wonder if workflow actions could be relevant in some way.
VI
Viva
1 year ago
I practiced a similar question, and I think macros were mentioned, but I don't see how they fit in with CIM.
YU
Yun
1 year ago
I feel like lookups might be the answer, but I also recall that field aliases are important for normalization.
TO
Tomas
1 year ago
I think the CIM uses field extractions, but I'm not completely sure. I remember something about it in the study materials.
LI
Lindsey
1 year ago
I'm a bit confused by the options. Some of them seem contradictory, so I'll need to really focus on the specifics of the event to choose the right two statements.
TO
Toi
1 year ago
This looks like a tricky question. I'll need to think through the steps carefully.