Module 8 Creating and Managing Fields

Question 1

what are the field extractor (FX) methods?

Answer 1

Regex

Delimeter

Question 2

what three options can you use to get to the field extractor?

Answer 2

• Settings
• Fields sidebar
• Event actions

Question 3

Prior to search time what fields are stored with the event in the index?

Answer 3

Metafields such as host, source and sourcetype

internal fields as _time and _raw

Question 4

True or False

In addition to the auto-extracted fields you can extract your own fields

Answer 4

True

Question 5

When would you use the Regex field extraction option?

Answer 5

-when you events contains unstructured data

FX attempts to extract fields using Regex to match simliar events

Question 6

When would you use the delimiter field extraction option

Answer 6

• structured data like a csv file

- data doesn’t have headers and is separated by delimiters

Question 7

extraction names are provided by default, can these be changed?

Answer 7

yes

Question 8

if you manually edit the the regular expression can you then edit in the Field Extractor UI

Answer 8

No