Field aliases are alternative names for fields in Splunk. Field aliases can be used to normalize data across
different sources and sourcetypes that have different field names for the same concept. For example, you can
create a field alias for src_ip that maps to clientip, source_address, or any other field name that represents the
source IP address in different sourcetypes. Field aliases can also be used in lookup file definitions to map
fields in your data to fields in the lookup file. For example, you can use a field alias for src_ip to map it to
ip_address in a lookup file that contains geolocation information for IP addresses. Field alias names do not
replace the original field name, but rather create a copy of the field with a different name. Field alias names
are case sensitive when used as part of a search, meaning that src_ip and SRC_IP are different fields.

The following commands are used when creating visualizations: geom, geostats, and iplocation.
Visualizations are graphical representations of data that show trends, patterns, or comparisons. Visualizations can have different types, such as charts, tables, maps, etc. Visualizations can be created by using various commands that transform the data into a suitable format for the visualization type. Some of the commands that are used when creating visualizations are:
* geom: This command is used to create choropleth maps that show geographic regions with different
* colors based on some metric. The geom command takes a KMZ file as an argument that defines the geographic regions and their boundaries. The geom command also takes a field name as an argument that specifies the metric to use for coloring the regions.
* geostats: This command is used to create cluster maps that show groups of events with different sizes and colors based on some metric. The geostats command takes a latitude and longitude field as arguments that specify the location of the events. The geostats command also takes a statistical function as an argument that specifies the metric to use for sizing and coloring the clusters.
* iplocation: This command is used to create location-based visualizations that show events with different attributes based on their IP addresses. The iplocation command takes an IP address field as an argument and adds some additional fields to the events, such as Country, City, Latitude, Longitude, etc. The iplocation command can be used with other commands such as geom or geostats to create maps based on IP addresses.

The Splunk Common Information Model (CIM) provides a methodology to normalize data from different sources and source types. The CIM defines a common set of fields and tags for different types of data, such as web, network, email, etc. This allows you to search and analyze data from different sources in a consistent way.

Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/WhatisSplunkknowledge