SPLK-1003 · Question #85
In which phase do indexed extractions in props.conf occur?
The correct answer is B. Parsing phase. Indexed extractions defined in props.conf occur during the parsing phase, where Splunk processes and enriches events before writing them to disk.
Question
In which phase do indexed extractions in props.conf occur?
Options
- AInputs phase
- BParsing phase
- CIndexing phase
- DSearching phase
How the community answered
(31 responses)- A3% (1)
- B87% (27)
- C3% (1)
- D6% (2)
Why each option
Indexed extractions defined in props.conf occur during the parsing phase, where Splunk processes and enriches events before writing them to disk.
The inputs phase handles initial data receipt and routing from input processors to the parsing queue; field extraction has not yet begun at this stage.
The parsing phase is where Splunk applies line breaking, timestamp recognition, and indexed field extractions specified in props.conf; these extractions are stored with the event at index time, meaning the extracted fields are available without re-processing during search, unlike search-time extractions which are applied on demand.
The indexing phase writes already-parsed and processed event data to disk; by this phase, parsing-phase extractions have already been applied.
The searching phase applies search-time field extractions from transforms.conf or props.conf EXTRACT- settings on demand; indexed extractions from props.conf are not performed here.
Concept tested: Splunk data processing pipeline - indexed extractions at parse time
Source: https://docs.splunk.com/Documentation/Splunk/latest/Data/Aboutindexingprocesses
Topics
Community Discussion
No community discussion yet for this question.