In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?
In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?
In the Splunk Enterprise data pipeline, indexed extraction configurations are processed during the parsing phase. The parsing phase is responsible for interpreting the raw data and breaking it down into events, which includes indexed extraction configurations to identify and extract fields from the data.
C is correct. https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Configurationparametersandthedatapipeline
None of these are correct. According to: https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Configurationparametersandthedatapipeline INDEXED_EXTRACTIONS occur during the Structure parsing phase, which is between the Input and Parsing phases. I guess the answer should be C. Parsing, but none of these answer is exactly right.
C. Parsing