SPLK-1002 · Question #252
Using the Field Extractor (FX) tool, a value is highlighted to extract and give a name to a new field. Splunk has not successfully extracted that value from all appropriate events. What steps can be…
The correct answer is A. Select an additional sample event with the Field Extractor (FX) and highlight the missing value D. Edit the regular expression manually. When the Field Extractor (FX) does not successfully extract a value from all applicable events using regex mode, two valid remediation steps are: (A) selecting additional sample events in the FX and highlighting the missing value - this provides more examples for Splunk to…
Question
Using the Field Extractor (FX) tool, a value is highlighted to extract and give a name to a new field. Splunk has not successfully extracted that value from all appropriate events. What steps can be taken so Splunk successfully extracts the value from all appropriate events? (select all that apply)
Options
- ASelect an additional sample event with the Field Extractor (FX) and highlight the missing value
- BRe-ingest the data and attempt to extract from a new dataset.
- CClick on the event where the field was not extracted and choose "Change to Delimited".
- DEdit the regular expression manually.
How the community answered
(33 responses)- A85% (28)
- B9% (3)
- C6% (2)
Explanation
When the Field Extractor (FX) does not successfully extract a value from all applicable events using regex mode, two valid remediation steps are: (A) selecting additional sample events in the FX and highlighting the missing value - this provides more examples for Splunk to refine the auto-generated regex - and (D) manually editing the regular expression to make it more broadly applicable. Re-ingesting data (B) would not affect the extraction logic. Changing to 'Delimited' mode (C) only makes sense for delimited data and would not fix a regex extraction problem for unstructured log data.
Topics
Community Discussion
No community discussion yet for this question.