Using Fields and Lookups →hardMultiple SelectObjective-mapped

SPLK-1001 Using Fields and Lookups Practice Question

Which THREE of the following are capabilities of the rex command?

⚠ Common exam trap

Splunk often tests the distinction between `rex` and `sed` commands, where candidates confuse `rex`'s regex extraction with `sed`'s text replacement, or assume `rex` can set default values like `eval` does.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Extract fields using regex named groups.

The `rex` command can extract fields using regex named groups, where the group name becomes the field name and the matched value becomes the field value. This is a core capability of `rex` for field extraction in Splunk.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Perform case-insensitive extraction by default.
Why it's wrong here
rex is case-sensitive by default.
✓
Extract fields using regex named groups.
Why this is correct
The primary use of rex.
✓
Replace text using sed expressions.
Why this is correct
rex mode=sed enables text substitution.
✗
Set a default value for a field.
Why it's wrong here
Use eval for default values.
✓
Extract fields from a specific field using field parameter.
Why this is correct
rex can operate on any field, not just _raw.

Go deeper

SPLK-1001 Using Fields and Lookups Practice Question

Why each option matters

Option-by-option breakdown

Related to this question