Splunk Core Certified Power User — Question 135

When would a user select delimited field extractions using the Field Extractor (FX)?

Answer options

• A. With structured files such as JSON or XML.
• B. When the file has a header that might provide information about its structure or format.
• C. When a log file has values that are separated by the same character, for example, commas.
• D. When a log file contains empty lines or comments.

Correct answer: C

Explanation

The correct answer is C because delimited field extractions are specifically used when values in a log file are consistently separated by a delimiter, like commas. Options A and B involve structured data that doesn't require delimitation, while D refers to irrelevant content that does not help in extracting fields.