An analyst needs to create a new field at search time. Which Splunk command will dynamically extract additional fields as part of a Search pipeline?

Question

Options

• Arex
• Bfields
• Cregex
• Deval

• A
  88% (45)
• B
  6% (3)
• C
  2% (1)
• D
  4% (2)

Explanation

rex is correct because it uses regular expressions to dynamically extract new fields from existing field values at search time, adding them to events as part of the pipeline without modifying the underlying data or index.

• B. fields - only includes or excludes existing fields from results; it cannot create or extract new ones.
• C. regex - filters events by matching a pattern (like WHERE for regex), but does not extract or create fields.
• D. eval - creates calculated fields by evaluating expressions (math, string operations, conditionals), but it computes values from existing fields rather than extracting them from raw text via pattern matching.

Memory tip: Think "rex = regex extract" - the name itself hints at its purpose. If you need to pull a new field out of raw text using a pattern, reach for rex; if you need to calculate a new field from existing values, use eval.

No community discussion yet for this question.