A calculated field may be based on which of the following?

A calculated field is created at search time by applying an eval expression to the values of other fields within an event. For the calculation to be possible, the fields used in the expression must already exist in the event. These existing fields are known as extracted fields, which can be default fields (e.g., host, source), fields extracted using regular expressions, or fields added by other processes like lookups. Therefore, the fundamental component that a calculated field is based on is one or more previously extracted fields.

1. Splunk Enterprise Documentation

Knowledge Manager Manual

"About calculated fields": This section states

"Calculated fields are fields added to events at search time that perform calculations with the values of two or more fields already present in those events." This confirms that calculated fields operate on pre-existing fields.

(Source: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutcalculatedfields)

2. Splunk Enterprise Documentation

props.conf Specification: The documentation for the EVAL- setting in props.conf specifies: "The is a valid eval command expression... The expression can reference other fields that are extracted from the same event." This explicitly links the calculation to other extracted fields.

(Source: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Section: Calculated fields)

3. Splunk Education

Splunk Core Certified Power User Courseware: In the module on "Creating and Managing Fields

" the course material demonstrates that calculated fields are defined using eval expressions that take existing fields as input. For example

EVAL-kb = bytes/1024 creates a new field kb based on the value of the existing field bytes.