Splunk
SPLK-2002(205Q) · Question #81
A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following…
Sign in or unlock SPLK-2002(205Q) to reveal the answer and full explanation for question #81. The question stem and answer options stay visible for context.
Splunk Knowledge Management
Question
A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)
Options
- AThe field was extracted as a private knowledge object.
- BThe events are tagged as communicate, but are missing the network tag.
- CThe Typing Queue, which does regular expression replacements, is blocked.
- DThe colleague did not explicitly use the field in the search and the search was set to Fast Mode.
Unlock SPLK-2002(205Q) to see the answer
You've previewed enough free SPLK-2002(205Q) questions. Unlock SPLK-2002(205Q) for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#field extraction#knowledge object permissions#search modes#Fast Mode