Examice

Exam SPLK-1002 All QuestionsBrowse all questions from this exam

Go to Exam

Question 61

Which of the following statements describes the use of the Field Extractor (FX)?

The Field Extractor automatically extracts all fields at search time.

The Field Extractor uses PERL to extract fields from the raw events.

Fields extracted using the Field Extractor persist as knowledge objects.

Fields extracted using the Field Extractor do not persist and must be defined for each search.

Correct Answer: C

Fields extracted using the Field Extractor persist as knowledge objects. This means that once fields are extracted using the Field Extractor, they are saved and can be referenced in future searches without needing to be defined again.

Discussion

okseyOption: C

Fields extracted using the Field Extractor persist as knowledge objects.

mybox1Option: C

C - page 151

mardaOption: C

C - P151