Perform Regex Field Extractions Using the Field Extractor (FX) SPLK-1002 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Splunk admin is using the Field Extractor to create a regex extraction for a field called 'duration' in performance logs. The logs contain lines like: duration=123ms. The admin highlights '123' in the sample event, and the FX generates the regex: (?<duration>\d+). The preview shows the field correctly on the sample event. However, when the admin tests the extraction on a different event with the duration '1.5s', the field does not appear. What is the most likely reason?

   • AThe regex is case-sensitive, and the duration in the second event is in a different case.
   • BThe regex is not anchored to the beginning of the event, so it cannot match a duration that appears later in the event.
   • CThe regex \d+ only matches digits, so it stops at the decimal point in '1.5s'.
   • DThe regex is too restrictive because it only matches durations in milliseconds, and '1.5s' is in seconds.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   After highlighting a value in the Field Extractor, what does the FX do next in the interactive workflow?

   • AIt generates a regular expression and displays a preview of extracted values
   • BIt asks the user to enter a field name before proceeding
   • CIt immediately saves the extraction to the app
   • DIt runs a search to find all events with the highlighted text
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Splunk admin is using the Field Extractor to create a regex extraction for a new log source. The logs contain a mix of INFO, WARN, and ERROR events, but the admin only needs to extract a session_id field that appears exclusively in ERROR events. The admin selects 10 sample events that are all ERROR events and completes the extraction. After saving, the session_id field is not appearing on any events in search results. What is the most likely cause?

   • AThe sample events did not include any INFO or WARN events, so the extraction was not applied to the sourcetype.
   • BThe regex was written to match the session_id pattern only in the context of the surrounding ERROR log line, so it fails on events where the surrounding text differs.
   • CThe extraction was saved to the wrong app, so it is not available in the search app where the user is searching.
   • DThe field extractor only works on the first 10 events in the index, so the session_id field is only extracted from those events.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A user is viewing a search result and wants to create a new field extraction from that event. Which action directly opens the Field Extractor?

   • AClicking the event's timestamp
   • BSelecting 'Extract Fields' from the event's action menu
   • CClicking the 'Save As' button on the search page
   • DTyping 'field extractor' in the search bar
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which set of sample events is most appropriate to select when using the Field Extractor to extract a field that appears in log messages?

   • AEvents that show different variations of the field value
   • BEvents that are from the most recent time range
   • CEvents that contain no other fields
   • DEvents that all have the same timestamp
   Reveal Solution Discussion Select an answer first