A Splunk admin is optimizing a search that uses a regex to extract fields from events. The regex is '.*error.*(? \d+)'. The admin notices the search is slow. Which change would most improve the regex performance?

Add more alternation to the regex

Remove the word 'error' from the regex

Replace the leading '.*' with a more specific pattern or anchor

Change the trailing '\d+' to '\d*'

SplunkCore Certified Advanced Power User

Domain 2Objective 2

Field Extractions core-certified-advanced-power-user Practice Questions (Page 4)

Part of the Fields, Lookups, and Data domain, which makes up ~17% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

5concepts

Questions 16–17

16foundation · easy
Which rex command correctly extracts the value of the 'status' field using a named group?
Select an answer first
17expert · hard
A Splunk admin is optimizing a search that uses a regex to extract fields from events. The regex is '.*error.*(?<code>\d+)'. The admin notices the search is slow. Which change would most improve the regex performance?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to core-certified-advanced-power-user

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “core-certified-advanced-power-user” is a trademark of its owner, used for identification only.

Field Extractions core-certified-advanced-power-user Practice Questions (Page 4)

Questions 16–17

Which rex command correctly extracts the value of the 'status' field using a named group?

A Splunk admin is optimizing a search that uses a regex to extract fields from events. The regex is '.*error.*(?<code>\d+)'. The admin notices the search is slow. Which change would most improve the regex performance?

Keep studying — Fields, Lookups, and Data

A Splunk admin is optimizing a search that uses a regex to extract fields from events. The regex is '.error.(?<code>\d+)'. The admin notices the search is slow. Which change would most improve the regex performance?