A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following…

Question

Options

• AThe field was extracted as a private knowledge object.
• BThe events are tagged as communicate, but are missing the network tag.
• CThe Typing Queue, which does regular expression replacements, is blocked.
• DThe colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Explanation

Splunk Field Visibility - Correct Answers: A and D

A is correct because Splunk knowledge objects - including field extractions - default to private when created. A private extraction is only visible to the user who created it. Until the original user changes the permissions to share it with a role or app, the colleague will never see src_ip in their results, even on identical events.

D is correct because Splunk's Fast Mode disables automatic field discovery to speed up searches. Only fields explicitly referenced in the SPL query (e.g., | stats count by src_ip) are extracted and surfaced. If the colleague just ran a broad search without mentioning src_ip, the field is silently skipped.

B is wrong because CIM tags like communicate and network govern data model classification, not whether a raw field extraction is visible. Missing a tag affects datamodel searches, not ad-hoc field visibility.

C is wrong because a blocked Typing Queue (which handles index-time transforms) would be a system-wide problem affecting all users and all searches - it cannot selectively hide a field from one person while leaving another unaffected.

Memory tip: Think of it as two separate "gates" - the sharing gate (A: private vs. shared permissions) and the search mode gate (D: Fast Mode skips undeclared fields). Both gates can silently hide a field from a colleague without any error message.

No community discussion yet for this question.