Splunk Core Certified Power User — Question 109

What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

Answer options

• A. There is a limit to the number of fields that can be extracted.
• B. The user is unable to return to the automatic field extraction workflow.
• C. The user is unable to preview the extractions.
• D. The extraction is added at index time.

Correct answer: B

Explanation

When a user edits the regex field extraction, they lose the ability to return to the automatic extraction process, which is why option B is correct. The other options do not accurately describe the consequences of modifying the field extraction; there are no limits on the number of fields extracted, previewing extractions remains possible, and the timing of the extraction remains unaffected.