フリー問題

問題文

A lookup keys on a column whose name differs from the field name in the events. What are the two ways to make it match, and which is preferable?

選択肢

1. Map the names in the search or in the definition; mapping in the definition avoids repeating it in every search that uses the lookup.
2. Add the event's field name as a second key column in the file, or accept that the lookup will match nothing; adding the column is preferable because it makes the file work with any naming.
3. Use a wildcard on the key, or make the definition case-insensitive; the wildcard is preferable because it tolerates any difference in the two names.
4. Rename the field in the events or rename the column in the file; renaming the field in the events is preferable because it fixes the mismatch for every future search at once.