A support analyst needs to extract a field called 'error_code' from log events. The analyst does not know the exact regex pattern but can provide several example values such as 'ERR-404', 'ERR-500', and 'ERR-302'. Which Splunk command should the analyst use to automatically generate the extraction?

| erex error_code examples="ERR-404", "ERR-500", "ERR-302"

A Splunk user needs to extract a field called 'transaction_id' from events that contain 'txn=TXN-abc123'. The user does not know the exact regex pattern but can provide example values like 'TXN-abc123' and 'TXN-def456'. Which Splunk command should the user use to automatically generate the extraction?

| rex transaction_id="TXN-(? \w+)"

| extract transaction_id="TXN-\w+"

| regex transaction_id="TXN-\w+"

| erex transaction_id examples="TXN-abc123", "TXN-def456"

A Splunk user needs to extract a field called 'product_code' from events that contain values like 'SKU-12345' and 'SKU-67890'. The user is not comfortable writing regular expressions manually. Which approach should the user take to create the extraction?

Use the Field Extractor and manually type the regex

Use the rex command with a manually written regex

Use the extract command with delimiters

Use the erex command with the example values 'SKU-12345' and 'SKU-67890'

Which of the following is a requirement for using the erex command?

Using the command in a subsearch

Specifying the field name in the command

Providing example values of the field you want to extract

Having a lookup table with the field values

A security analyst needs to extract the destination IP address from events that contain lines like 'dst=10.0.0.25 port=443'. The analyst wants to perform this extraction only for the current search, without modifying the underlying data or creating a persistent field. Which approach should the analyst use?

Use the rex command with a named group: | rex field=_raw "dst=(? \d+\.\d+\.\d+\.\d+)"

Use the erex command with example values: | erex dest_ip examples="10.0.0.25"

Use the Field Extractor to create a regex extraction and save it as a custom field

Use index-time extraction by configuring transforms.conf and props.conf

SplunkCore Certified Advanced Power User

Domain 2Objective 2

Field Extractions core-certified-advanced-power-user Practice Questions (Page 1)

Part of the Fields, Lookups, and Data domain, which makes up ~17% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

5concepts

Questions 1–5

1application · medium
A support analyst needs to extract a field called 'error_code' from log events. The analyst does not know the exact regex pattern but can provide several example values such as 'ERR-404', 'ERR-500', and 'ERR-302'. Which Splunk command should the analyst use to automatically generate the extraction?
Select an answer first
2application · medium
A Splunk user needs to extract a field called 'transaction_id' from events that contain 'txn=TXN-abc123'. The user does not know the exact regex pattern but can provide example values like 'TXN-abc123' and 'TXN-def456'. Which Splunk command should the user use to automatically generate the extraction?
Select an answer first
3application · medium
A Splunk user needs to extract a field called 'product_code' from events that contain values like 'SKU-12345' and 'SKU-67890'. The user is not comfortable writing regular expressions manually. Which approach should the user take to create the extraction?
Select an answer first
4foundation · easy
Which of the following is a requirement for using the erex command?
Select an answer first
5application · medium
A security analyst needs to extract the destination IP address from events that contain lines like 'dst=10.0.0.25 port=443'. The analyst wants to perform this extraction only for the current search, without modifying the underlying data or creating a persistent field. Which approach should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to core-certified-advanced-power-user

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “core-certified-advanced-power-user” is a trademark of its owner, used for identification only.

Field Extractions core-certified-advanced-power-user Practice Questions (Page 1)

Questions 1–5

A support analyst needs to extract a field called 'error_code' from log events. The analyst does not know the exact regex pattern but can provide several example values such as 'ERR-404', 'ERR-500', and 'ERR-302'. Which Splunk command should the analyst use to automatically generate the extraction?

A Splunk user needs to extract a field called 'product_code' from events that contain values like 'SKU-12345' and 'SKU-67890'. The user is not comfortable writing regular expressions manually. Which approach should the user take to create the extraction?

Which of the following is a requirement for using the erex command?

Keep studying — Fields, Lookups, and Data