ExamTopics Logo
Mail Us[email protected]
Menu
Splunk Discussions
exam questions

Exam SPLK-2002 All Questions

View all questions & answers for the SPLK-2002 exam
Go to Exam

Exam SPLK-2002 topic 1 question 55 discussion

Actual exam question from Splunk's SPLK-2002
Question #: 55
Topic #: 1
[All SPLK-2002 Questions]

In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?

  • A. Input
  • B. Search
  • C. Parsing
  • D. Indexing
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️
Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Configurationparametersandthedatapipeline
by Powdered_Sugar at Dec. 21, 2021, 4:16 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
pawkers
2 weeks, 3 days ago
Selected Answer: A
Splunk Enterprise Data Administration PDF Indexed extractions are input phase props.conf settings
upvoted 1 times
pawkers
2 weeks, 3 days ago
Page 345 - Splunk Enterprise 9.0 Data Administration PDF
upvoted 1 times
...
...
adamsca
10 months ago
Selected Answer: C
C. Parsing
upvoted 2 times
...
bpettengill
2 years, 2 months ago
C is correct. https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Configurationparametersandthedatapipeline
upvoted 4 times
...
Powdered_Sugar
2 years, 7 months ago
None of these are correct. According to: https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Configurationparametersandthedatapipeline INDEXED_EXTRACTIONS occur during the Structure parsing phase, which is between the Input and Parsing phases. I guess the answer should be C. Parsing, but none of these answer is exactly right.
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel