A field alias is created where field1—fieid2 and the Overwrite Field Values checkbox is selected. What happens if an event only contains values for…

The correct answer is D. field2 values are replaced with the value of the field1.

A field alias is a way to associate an additional (new) name with an existing field name. A field alias

can be used to normalize fields from different sources that have different names but represent the

same data. Field aliases can also be used to rename fields for clarity or convenience1.

When you create a field alias in Splunk Web, you can select the Overwrite Field Values option to

change the behavior of the field alias. This option affects how the Splunk software handles situations

where the original field has no value or does not exist, as well as situations where the alias field

already exists as a field in your events, alongside the original field2.

If you select the Overwrite Field Values option, the following rules apply:

If the original field does not exist or has no value in an event, the alias field is removed from that

event.

If the original field and the alias field both exist in an event, the value of the alias field is replaced

with the value of the original field.

If you do not select the Overwrite Field Values option, the following rules apply:

If the original field does not exist or has no value in an event, the alias field is unchanged in that

event.

If the original field and the alias field both exist in an event, both fields are retained with their

respective values.

Therefore, if you create a field alias where field1—field2 and select the Overwrite Field Values

option, and an event only contains values for field1, then the value of field2 will be replaced with the

value of field1.

Reference:

About calculated fields

About field aliases

Create field aliases in Splunk Web