SPLK-1002 Macros, Saved Searches and CIM Practice Question

Order the steps to configure a field extraction using the Field Extractor (FX) in Splunk.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

1. Select a sample event, 2. Highlight the field value in the event, 3. Name the field, 4. Save the extraction.

The Field Extractor guides you through selecting sample data, defining extraction rules, testing, and saving.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
1. Select a sample event, 2. Highlight the field value in the event, 3. Name the field, 4. Save the extraction.
Why this is correct
This is the correct order because the Field Extractor requires you to first choose a sample event to work with, then identify the specific value by highlighting it, then assign a field name, and finally save the configuration.
✗
1. Highlight the field value, 2. Select a sample event, 3. Name the field, 4. Save the extraction.
Why it's wrong here
This is incorrect because you must select a sample event before you can highlight a field value. Highlighting without a selected event is not possible.
✗
1. Name the field, 2. Select a sample event, 3. Highlight the field value, 4. Save the extraction.
Why it's wrong here
This is incorrect because naming the field occurs after highlighting the value, not before. The Field Extractor prompts for a name only after you have highlighted the desired text.
✗
1. Select a sample event, 2. Name the field, 3. Highlight the field value, 4. Save the extraction.
Why it's wrong here
This is incorrect because you highlight the field value before naming it. The naming step typically appears right after highlighting the value in the Field Extractor interface.

Go deeper