Q: 18
During the validation step of the Field Extractor workflow: Select your answer.
Options
Discussion
Remove values that aren't a match. That's what the validation step actually does in the Field Extractor-you can deselect bad matches but you can't change the extraction logic itself. Pretty sure it's A here, not B or C.
Had something like this in a mock, it's A. You can remove values that don't fit the field you want during validation. Not totally sure if Splunk changed anything recently, but pretty confident on this one.
Not sure, I'd pick C here. In validation you just review the extracted values, I thought actual changes to the field extraction regex happen earlier in the process. Someone confirm?
A. Removing unmatched values is what you can actually do in validation, not directly changing the regex. I got a similar question on a practice set where B was tempting, but only A fits the Field Extractor step details.
A, seen something almost identical in a mock. If the question was about modifying regex, would that change which option fits?
Don’t think it’s A. I picked C since during validation you’re just checking the results and not tweaking the extraction logic directly. Easy to mix up since you can remove values, but modifying extraction feels like a step before. Open to corrections if I missed something.
I don't think it's A, I'd go with C. In the validation step you can't really change the extraction, just review what's already pulled in. The wording always trips me up here-maybe I'm missing something?
Be respectful. No spam.
