All search-time field extractions should be specified on which Splunk component?

The correct answer is D. Search head. Search-time field extractions (defined in transforms.conf and props.conf) are applied when a user runs a search, not at index time. Because the Search Head is the component that executes searches and applies search-time knowledge objects, all search-time field extraction configur

Distributed Search

Question

Options

ADeployment server
BUniversal forwarder
CIndexer
DSearch head

How the community answered

(39 responses)

A
3% (1)
B
3% (1)
D
95% (37)

Explanation

Search-time field extractions (defined in transforms.conf and props.conf) are applied when a user runs a search, not at index time. Because the Search Head is the component that executes searches and applies search-time knowledge objects, all search-time field extraction configurations should reside there. Placing these on forwarders or indexers would have no effect on search-time processing.

Topics

#Search-time field extractions#Splunk components#Search head functions#Knowledge objects

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice