フリー問題

問題文

A calculated field must apply only to the events whose response code is 200, and only for one source type. What does the documentation advise, given that a calculated field cannot be scoped to an aliased host, source, or source type?

選択肢

1. Move the computation to a lookup keyed on the response code, because a lookup can be scoped to an aliased source type.
2. Create an alias for the response code first and scope the calculated field to that alias, because aliases are processed before calculated fields.
3. Define two calculated fields, one for each outcome, and let the second override the first when the condition does not hold.
4. Filter the events inside the expression with a conditional function, rather than trying to scope the field to an alias.