QuestionQ24Verified/Creating and Managing FieldsCopy linkReport a problemAsk AstroTutorSave questionWhich option best describes the process used to tokenize event data?AThe event data is broken up by values in the punct field.BThe event data is broken up by major breakers and then broken up further by minor breakers.CThe event data is broken up by a series of user-defined regex patterns.DThe event data has all punctuation stripped out and is then space delimited.Show AnswerAnswerExplanationSplunk segments event data by first dividing terms with major breakers and then further dividing the resulting segments with minor breakers. Major and minor breakers are sets of delimiter characters used to create searchable tokens.Learn moreSplunk Documentation: Event segmentation and searchingShow comments1Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion