Splunk Exam SPLK-1005 Topic 11 Question 3 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 3
Topic #: 11

[All SPLK-1005 Questions]

Which of the following methods is valid for creating index-time field extractions?

AUse the UI to create a sourcetype, specify the field name and corresponding regular expression with capture statement.

BCreate a configuration app with the index-time props.conf and/or transfoms. conf, and upload the app via UI.

CUse the CU app to define settings in fields.conf, and restart Splunk Cloud.

DUse the rex command to extract the desired field, and then save as a calculated field.

Show Suggested Answer

Suggested Answer: B

The valid method for creating index-time field extractions is to create a configuration app that includes the necessary props.conf and/or transforms.conf configurations. This app can then be uploaded via the UI. Index-time field extractions must be defined in these configuration files to ensure that fields are extracted correctly during indexing.

Splunk Documentation Reference: Index-time field extractions

by Leonora at Oct 24, 2024, 08:52 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Matthew

3 days ago

I agree with Elly, option A seems like the correct method for creating index-time field extractions.

upvoted 0 times

...

Elly

5 days ago

I think option A is valid because you can specify the field name and regular expression.

upvoted 0 times

...