A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)
A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)
If the field was extracted as a private knowledge object, it would only be visible to the user who created the extraction unless they share it, which explains why their colleague cannot see it. Additionally, if the colleague did not explicitly use the field in the search and the search was set to Fast Mode, Splunk might not display all available fields to optimize search performance.
A and D
A and D are correct
A and D
A and D is correct
Could be A and D
page 101 troubleshooting