nerdexam
Splunk

SPLK-1002 · Question #92

In the Field Extractor Utility, this button will display events that do not contain extracted fields.

The correct answer is B. Non-Matches. In Splunk's Field Extractor (FX) utility, the 'Non-Matches' button filters the event list to show only events where the current regex or delimiter pattern did not extract the target field. This helps you identify edge cases and refine your extraction pattern to achieve broader…

Creating and Managing Fields

Question

In the Field Extractor Utility, this button will display events that do not contain extracted fields.

Options

  • ASelected-Fields
  • BNon-Matches
  • CNon-Extractions
  • DMatches

How the community answered

(43 responses)
  • A
    2% (1)
  • B
    95% (41)
  • D
    2% (1)

Explanation

In Splunk's Field Extractor (FX) utility, the 'Non-Matches' button filters the event list to show only events where the current regex or delimiter pattern did not extract the target field. This helps you identify edge cases and refine your extraction pattern to achieve broader coverage.

Topics

#Field Extractor Utility#Field Extraction#Non-Matches

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SPLK-1002 Practice