A new parsing rule is created, and during testing and verification, all the logs for which field data is to be parsed out are missing. All the other logs from this data source appear as expected…

Question

Options

• AThe Broker VM is offline
• BThe parsing rule corrupted the database
• CThe filter stage is dropping the logs
• DThe XDR Collector is dropping the logs

• A
  7% (2)
• C
  81% (22)
• D
  11% (3)

Explanation

Option C is correct because the filter stage in a log processing pipeline determines which logs are selected for further processing - if the parsing rule's filter condition is misconfigured (e.g., wrong field match or syntax error), the pipeline will silently drop only the logs that match that filter criteria, leaving all other logs from the same source unaffected. This perfectly matches the symptom: specific logs are missing while others from the same data source pass through normally.

Why the distractors are wrong:

• A (Broker VM offline): A downed Broker VM would block all ingestion from that data source, not just specific log types.
• B (parsing rule corrupted the database): Parsing rules manipulate field extraction; they don't have write access to corrupt underlying database structures.
• D (XDR Collector dropping logs): Like the Broker VM, a collector issue would cause a broad outage affecting all logs from the source, not a selective gap tied to the new rule.

Memory tip: Think of the filter stage as a gatekeeper - if the gate is misconfigured, it turns away only the specific visitors (logs) it was told to screen, while everyone else walks right in. When only targeted logs vanish after a new rule is added, suspect the filter before the infrastructure.

No community discussion yet for this question.