The correct answer isA. Field alias123.
In Splunk, a field alias is a knowledge object that you can use to assign an alternate name to a field3.This can
be particularly useful when you want to normalize your data to comply with the Splunk Common Information
Model (CIM)12.
The CIM provides a methodology for normalizing values to a common field name1.It acts as a search-time
schema to define relationships in the event data while leaving the raw machine data intact2.By using field
aliases, you can map vendor fields to common fields that are the same for each data source in a given
domain4.This allows you to correlate events from different source types by normalizing these different
occurrences to a common structure and naming convention1.