Splunk Core Certified Power User — Question 196

The Field Extractor (FX) is used to extract a custom field. A report can be created using this custom field. The created report can then be shared with other people in the organization.
If another person in the organization runs the shared report and no results are returned, why might this be? (Choose all that apply.)

Answer options

• A. Fast mode is enabled.
• B. The dashboard is private.
• C. The extraction is private.
• D. The person in the organization running the report does not have access to the index.

Correct answer: C, D

Explanation

The correct answers are C and D because if the extraction is private, the other user won't be able to access it, and if they lack access to the index, they can't retrieve any data. Options A and B are incorrect since they do not directly prevent results from being returned; fast mode affects performance, and a private dashboard does not restrict report execution if the user has permission.