Creating Field Extractions Flashcards
Which of the following character delimiters are supported for a delimited field extraction?
- space
- tab
- comma
- pipe
space
tab
comma
pipe
True or False. Fields can be extracted only after indexing is complete.
TRUE
FALSE
False
Which of the following Regex operator can most severly impact performance, and may be considered “greedy”?
- (asterisk)
- \ (backslash)
- (plus sign)
- . (period)
* (asterisk)
Which of the following statements are true about a Regex “capture”?
* Defined with a matching parantheses: () * Allows the Regex to be case insensitive * Captures a matching pattern * Can be referenced with a given name using: ?<name>
* Defined with a matching parantheses: () * Allows the Regex to be case insensitive * Can be referenced with a given name using: ?<name>
True or False: If you manually edit the regular expression in the Field Extractor Utility then you will not be able to go back to validate the results.
FALSE
TRUE
True
Use this field extraction method when fields are separated by spaces, commas, or characters.
- rename field extractions
- regex field extractions
- delimited field extractions
delimited field extractions
When using regex for field extraction, what’s the first thing you have to do in the Field Extractor?
- Edit the regular expression
- Select a value to extract
- Set the Extractions Name and set permissions
- Provide a Field Name
Select a value to extract
Which of the following strings match this Regular Expression: c.t
- c#t
- c.t
- cat
- c99t
c#t
c.t
cat
There are three ways to get to the Field Extractor (FX). Select all that apply.
- Event Actions menu
- Fields sidebar
- Auto-Extract Fields Workflow
- Settings menu
Event Actions menu
Fields sidebar
Settings menu