フリー問題

Splunk Core Certified User のフリー問題 7 / 20 問目

問題文

A team wants a value to be available for filtering as cheaply as possible at search time, and also wants to be able to change how it is derived later. Which requirement has to give way?

選択肢

  1. Neither, because a field defined at index time is also re-evaluated at search time whenever its definition changes.
  2. Changeability, because a field extracted at search time is written back into the index the first time a search uses it, which fixes its definition.
  3. Cheapness, because every field is extracted at search time anyway, so the cost is identical either way.
  4. One of them, because a value held at index time is cheap to filter on but cannot be redefined for events already stored.

解答・解説を確認するには

正解と解説の確認、回答の記録には無料登録が必要です。登録すると演習モードでフリー問題に回答し、正誤と解説をその場で確認できます。