Perform Regex Field Extractions Using the Field Extractor (FX) SPLK-1002 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Splunk admin is using the Field Extractor to create a regex extraction for a field called 'ip_address' in firewall logs. The admin highlights the IP address in the sample event, and the FX generates the regex: (?<ip_address>\d+\.\d+\.\d+\.\d+). The preview shows the field correctly on the sample event. However, when the admin tests the extraction on a different event with an IPv6 address, the field does not appear. What is the most likely reason?

   • AThe regex is too restrictive because it only matches IP addresses with four octets, and IPv6 addresses have more than four octets.
   • BThe regex only matches IPv4 addresses, not IPv6 addresses, so it fails on IPv6 events.
   • CThe regex is not anchored to the beginning of the event, so it cannot match an IPv6 address that appears later in the event.
   • DThe regex is case-sensitive, and the IPv6 address is in a different case.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When saving a field extraction in the Field Extractor, what must the user specify?

   • AThe sourcetype of the events
   • BThe index from which the events were sourced
   • CThe time range for the extraction to apply
   • DThe app in which the extraction should be saved
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Splunk admin is using the Field Extractor to create a regex extraction for a field called 'user_id' in application logs. The logs contain lines like: user=jsmith action=login. The admin highlights 'jsmith' in the sample event, and the FX generates the regex: (?<user_id>\w+). The preview shows the field correctly on the sample event. However, when the admin tests the extraction on a different event with the user ID 'j.smith', the field does not appear. What is the most likely reason?

   • AThe regex \w+ matches word characters, but the dot in 'j.smith' is not a word character, so the regex stops at the dot.
   • BThe regex is not anchored to the beginning of the event, so it cannot match a user ID that appears later in the event.
   • CThe regex is case-sensitive, and the user ID in the second event is in a different case.
   • DThe regex is too restrictive because it only matches lowercase letters, and 'j.smith' contains a dot.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A Splunk admin is using the Field Extractor to create a regex extraction for a field called 'request_id' in API logs. The admin highlights the request ID in the sample event, and the FX generates the regex: (?<request_id>[a-f0-9-]+). The preview shows the field correctly on the sample event. However, when the admin tests the extraction on a different event with the request ID 'ABCD-1234', the field does not appear. What is the most likely reason?

   • AThe regex is case-sensitive, so it does not match uppercase letters in 'ABCD-1234'.
   • BThe regex is too broad and matches the first sequence of characters in the event, which is not the request ID in the second event.
   • CThe regex is not anchored to the beginning of the event, so it cannot match a request ID that appears later in the event.
   • DThe regex is too restrictive because it only matches hexadecimal characters, and 'ABCD-1234' contains non-hexadecimal characters.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Splunk admin is using the Field Extractor to create a regex extraction for a field called 'transaction_id' in a log source. The admin selects 5 sample events that all have the same format and completes the extraction. After saving, the admin notices that the field is not appearing on all events of the sourcetype. What is the most likely reason?

   • AThe admin did not select enough sample events, so the extraction was not applied to the sourcetype.
   • BThe extraction was saved to the wrong app, so it is not applied to the sourcetype.
   • CThe sample events were not representative of the variety of formats in the sourcetype, so the regex only matches the format seen in the samples.
   • DThe admin did not validate the extraction in the preview, so it was not saved correctly.
   Reveal Solution Discussion Select an answer first