Splunk Core Certified Power User — Question 191

After manually editing a regular expression (regex), which of the following statements is true?

Answer options

• A. Changes made manually can be reverted in the Field Extractor (FX) UI.
• B. It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.
• C. It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.
• D. The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.

Correct answer: B

Explanation

The correct answer is B because once a regular expression is manually edited, the Field Extractor (FX) UI does not allow further edits to that specific extraction. Other options are incorrect as changes can't be reverted (A), manual edits are possible (C), and the UI does not maintain a separate version of the extraction (D).