3.1 Deploy Parsing Rules for Unique Data Formats XSIAM-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is ingesting logs from a custom application that sometimes outputs fields in a JSON array (e.g., 'tags': ['admin', 'us-east-1']) and sometimes as a comma-separated string (e.g., 'tags=admin,us-east-1'). The parsing rule must extract the list of tags into a single field. What is the most robust approach?

   • AUse a regex pattern that matches both formats and captures the tags in a single group.
   • BCreate a transformation that detects whether the 'tags' field is an array or a string, and normalizes it to a comma-separated string in both cases.
   • CConfigure two separate parsing rules, one for JSON and one for key-value, and route events based on the presence of brackets.
   • DSet the parser to ignore the 'tags' field when it is an array and only process string values.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A parsing rule has been created for a custom log format. During testing, the rule successfully parses a sample event, but a second sample with an extra field at the end produces a 'field mapping error'. What is the most likely cause and the appropriate next step?

   • AThe sample data is malformed and should be discarded; the rule is correct as written.
   • BThe parser type is incorrect; switch from regex to key-value parsing to handle the extra field.
   • CThe field mapping is correct, but the transformation logic is failing; remove the transformation to fix the error.
   • DThe rule's regex is too strict and does not accommodate the optional trailing field; adjust the pattern to make the final segment optional.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A parsing rule fails with a regex error. What is the most likely cause?

   • AThe data source is not connected
   • BThe transformation logic is using an undefined function
   • CThe field mapping is incorrect
   • DThe regex pattern contains an unescaped special character
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A parsing rule is being created for a log format where the 'duration' field is in milliseconds, but the downstream system expects seconds. The raw value is '1500'. What should the parsing rule do to meet the requirement?

   • AAdd a transformation that divides the extracted value by 1000 and maps the result to the 'duration' field.
   • BSet the field's data type to float so the value can be stored as a decimal.
   • CChange the parser type to one that automatically converts milliseconds to seconds.
   • DModify the field mapping to rename 'duration' to 'duration_ms' to preserve the original unit.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A parsing rule is producing empty values for a field that should contain the username. What is the most likely cause?

   • AThe field mapping is correct but the data type is wrong
   • BThe parser type is correct but the log is too long
   • CThe regex pattern does not match the username portion of the log
   • DThe transformation logic is converting the username to uppercase
   Reveal Solution Discussion Select an answer first