SPLK-1002: Splunk Core Certified Power User

Create or replace an existing field.

CIM is a methodology for normalizing data.; CIM can correlate data from different sources.; The Knowledge Manager uses the CIM to create knowledge objects.

It behaves exactly like search strings before the first pipe.