Splunk Core Certified Power User — Question 137

When performing a regex field extraction with the Field Extractor (FX), a data type must be chosen before a sample event can be selected. Which of the following data types are supported?

Answer options

• A. index or source
• B. sourcetype or source
• C. sourcetype or host
• D. index or sourcetype

Correct answer: B

Explanation

The correct answer is B, as 'sourcetype' and 'source' are valid data types that can be selected when using the Field Extractor. Options A, C, and D include at least one invalid data type, making them incorrect for this context.