Splunk Enterprise Security Certified Analyst — Question 7

Which event processing pipeline contains the regex replacement processor that would be called upon to run event masking routines on events as they are ingested?

Answer options

• A. Merging pipeline
• B. Indexing pipeline
• C. Typing pipeline
• D. Parsing pipeline

Correct answer: C

Explanation

The correct answer is C, as the Typing pipeline is specifically designed to handle tasks like event masking using regex replacement. The Merging, Indexing, and Parsing pipelines do not focus on regex replacement for event masking during ingestion.