SPLK-1001 Using Fields and Lookups Practice Question
A search uses the rex command to extract fields from a log line. The field extraction is working correctly, but some events are missing the extracted field. What is a possible reason?
⚠ Common exam trap
Splunk often tests the misconception that rex always extracts a field for every event, when in reality it only extracts if the pattern matches — candidates may overlook the fundamental requirement of pattern presence in the raw data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The events that are missing the field do not contain the pattern.
The rex command extracts fields by matching a regex pattern against the raw event text. If an event does not contain the substring that matches the pattern, no field is extracted. This is the most direct and common reason for missing fields — the pattern simply isn't present in those events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The rex command does not support named groups.
Why it's wrong here
rex does support named groups.
- ✓
The events that are missing the field do not contain the pattern.
Why this is correct
If the pattern is not present, no field is extracted.
- ✗
The regex pattern is too complex.
Why it's wrong here
Complexity does not cause missing fields; it might cause performance issues.
- ✗
The rex command must be used with eval.
Why it's wrong here
rex is standalone and does not require eval.
Go deeper
Related to this question
About these practice questions
This SPLK-1001 question is part of Courseiva's 502-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.