Which knowledge objects can reference field aliases?

SPLK-1002 By islever Editorial Last updated

Short answer

C Calculated fields, lookups, event types, and tags.

Question

Which of the following knowledge objects can reference field aliases?
  1. Calculated fields and event types only.
  2. Calculated fields and tags only.
  3. Calculated fields, lookups, event types, and tags. Correct Answer
  4. Calculated fields, lookups, event types, and extracted fields.

Key Takeaways

This question tests your understanding of Splunk's search-time processing order, where field aliases are applied after extraction but before calculated fields, lookups, event types, and tags, which may then reference aliases.

In SPLK-1002, the correct answer is C: Calculated fields, lookups, event types, and tags. Community consensus confirms this by citing Splunk's search-time operation sequence.

Common mistake: Choosing A or B ignores that lookups and event types can also reference aliases. The trap is confusing extracted fields with knowledge objects that use aliases; extracted fields are the source, not a referencing object.

Expert Analysis

Why the Answer Is Correct

Splunk docs list search-time operations in order: field extraction, field aliases, calculated fields, lookups, event types, tags. Because aliases are defined before these later operations, calculated fields, lookups, event types, and tags can all reference field aliases. The options mention exactly that set.

Why the Other Options Are Wrong

A and B are incomplete: they leave out lookups and event types (and B excludes event types). D incorrectly includes extracted fields; extracted fields are created before aliasing and are not themselves knowledge objects that reference aliases. The correct set is C.

Community Comment Notes

One comment (likes=1) lists "Field Extractions > Field Aliases > Calculated Fields > Lookups > Event Types > Tags", confirming C. Another cites the official search-time operations sequence docs, and a third links to the Splunk 9.2.0 docs page. The community votes are uniformly for C.

Official Reference

https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Searchtimeoperationssequence

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the search-time operation order as a pipeline; when asked which objects can reference aliases, remember anything after aliases in the pipeline can use them, except extraction itself. Use mnemonics like "Extract, Alias, Calculate, Lookup, Event, Tag".

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. freeolive_guru 👍 1
    C. Calculated fields, lookups, event types, and tags. From result , which discusses the sequence of search-time operations: "These knowledge objects include extracted fields, calculated fields, lookup fields, field aliases, tags, and event types." Result mentions that field aliases can be used before field lookups: "Perform field aliasing after key-value extraction but before field lookups so that you can specify a lookup table based on a field alias." Result states that tags can be applied to any field/value pair, including those added through other methods: "You can apply tags to any field/value pair in an event, whether it is extracted at index time, search time, or added through some other method, such as an event type, lookup, or calculated field." Calculated fields can reference field aliases, as they come after field aliasing in the search-time operations sequence. Event types, being a higher-level abstraction, can also reference field aliases.
  2. Asheel1 👍 1 Answered C
    https://docs.splunk.com/Documentation/Splunk/9.2.0/Knowledge/Searchtimeoperationssequence
  3. NastyNutsu 👍 1 Answered C
    Field Extractions > Field Aliases > Calculated Fields > Lookups > Event Types > Tags
  4. Alexi2415 👍 1
    Field Extracted > Alias > Calculated Field > Lookup > Event Type > Tag

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Filter Events by Tag and Field in Splunk

S-grade

Which eval operator concatenates a string and a number in Splunk?

S-grade

Which Field Extractor method extracts a port number from an event?

S-grade

How to Pass Arguments to a Nested Macro in Splunk?

S-grade

Practice All SPLK-1002 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SPLK-1002 Practice Test →

← Back to SPLK-1002 Study Guide