正解:B
Reference:https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/definecalcfields
A calculated field is a field that you create based on the value of another field or fields1. You can use
calculated fields to enrich your data with additional information or to transform your data into a moreuseful
format1. Calculated fields can be based on extracted fields, which are fields that are extracted from your raw
data using various methods such as regular expressions, delimiters, or key-value pairs1. Therefore, option B is
correct, while options A, C and D are incorrect because tags, output fields for a lookup, and fields generated
from a search string are not types of extracted fields.