Exam SPLK-1005 topic 1 question 33 discussion

Actual exam question from Splunk's SPLK-1005

Question #: 33
Topic #: 1

[All SPLK-1005 Questions]

Which of the following methods is valid for creating index-time field extractions?

A. Use the UI to create a sourcetype, specify the field name and corresponding regular expression with capture statement.
B. Create a configuration app with the index-time props.conf and/or transforms.conf, and upload the app via UI.
C. Use the CLI app to define settings in fields.conf, and restart Splunk Cloud.
D. Use the rex command to extract the desired field, and then save as a calculated field.

Show Suggested Answer

Suggested Answer: B 🗳️

by pekata at April 5, 2025, 8:31 p.m.

Comments

Submit Cancel

2dd1c50

1 day, 11 hours ago

Selected Answer: B

The correct answer is: ✅ **B. Create a configuration app with the index-time props.conf and/or transforms.conf, and upload the app via UI.** Explanation: **Index-time field extractions** are configured using: * `props.conf`: to specify when and how to apply the extraction * `transforms.conf`: to define the actual extraction logic using regex or other methods These configurations **must be deployed via an app** and, in **Splunk Cloud**, are uploaded through the UI (under **Manage Apps > Upload app**).

upvoted 1 times

...