SPLK-2002: Splunk Enterprise Certified ArchitectDemo

Question

A Splunk user successfully extracted an IP address into a field named src_ip. Their colleague cannot see that field in search results for events known to contain src_ip. Which of the following could explain this issue? (Select all that apply.)

Choose two

A The field was extracted as a private knowledge object.
B The events are tagged as communicate, but are missing the network tag.
C The Typing Queue, which does regular expression replacements, is blocked.
D The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Explanation

A private field-extraction knowledge object is available only to its owner, preventing other users from seeing the resulting field. Fast Mode disables field discovery and does not perform search-time field extraction unless the field is explicitly included in the search. Tags are applied after field extractions, so the presence or absence of a network tag does not control extraction of src_ip.

Learn more

SPLK-2002: Splunk Enterprise Certified ArchitectDemo

AstroTutor

Notes

Readiness

QuestionQ66

Community Discussion