When performing a regex field extraction with the Field Extractor (FX), a data type must be chosen before a sample event can be selected. Which of the following data types are supported?

The correct answer is D. sourcetype or source. When using the Field Extractor (FX) in regex mode, you must first select a data type to determine which events are used as the sample pool. The two supported data types are sourcetype and source. Choosing sourcetype groups events by their sourcetype (e.g., access_combined), while

Creating and Managing Fields

Question

Options

Aindex or source
Bsourcetype or host
Cindex or sourcetype
Dsourcetype or source

How the community answered

(31 responses)

A
3% (1)
C
3% (1)
D
94% (29)

Explanation

When using the Field Extractor (FX) in regex mode, you must first select a data type to determine which events are used as the sample pool. The two supported data types are sourcetype and source. Choosing sourcetype groups events by their sourcetype (e.g., access_combined), while choosing source groups them by their source file or input path. index and host are not valid data type options in the FX workflow, as the FX is designed to extract fields based on how data is formatted - which is best defined by sourcetype or source.

Topics

#Field Extractor#Field Extraction#Regex#Splunk UI

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice