Creating and Managing Fields for Splunk Core Certified Power User

This page covers the Creating and Managing Fields domain of the Splunk Core Certified Power User certification. Master Cybersecurity offers 21 practice questions in this domain, drawn from the same content we use across our timed exam simulations. Below are five sample questions with full answer explanations.

Sample Practice Questions

  1. Question 1

    When using the Field Extractor (FX), which of the following delimiters will work? (Choose all that apply.)
    1. A. Tabs
    2. B. Pipes
    3. C. Colons
    4. D. Spaces
    Explanation

    The correct answers are: A. Tabs, B. Pipes, C. Colons, D. Spaces.

    The Field Extractor's delimited mode accepts any consistent character as a separator, so tabs, pipes, colons, and spaces all work. The interface offers the common separators as presets and provides an Other option where you type whatever character your data uses, which is what makes the answer inclusive rather than a short list. What matters is consistency rather than which character was chosen, because the same separator must divide every field in every event, since the tool splits on it positionally and assigns names to the resulting columns. Data that mixes separators, or uses one character both as a separator and inside a value, defeats this mode and calls for the regular expression method instead. That is the real dividing line to remember when choosing between the two extraction methods in the tool.

  2. Question 2

    There are several ways to access the field extractor. Which option automatically identifies the data type, source type, and sample event?
    1. A. Event Actions > Extract Fields
    2. B. Fields sidebar > Extract New Fields
    3. C. Settings > Field Extractions > New Field Extraction
    4. D. Settings > Field Extractions > Open Field Extractor
    Explanation

    The correct answer is: A. Event Actions > Extract Fields.

    Reaching the Field Extractor through Event Actions on a specific event is the route that fills in the context for you, because you have already selected a concrete event and Splunk can read its data type and sourcetype and use it as the sample. That skips the first step of the workflow and is why it is the usual starting point when you are looking at data and notice a field worth extracting. The Fields sidebar route to extract new fields starts the tool without a chosen event, so the sample still has to be selected. Opening the tool from Settings under Field Extractions likewise begins with nothing selected, leaving you to pick the data type and sample manually. Creating a new field extraction from Settings is a different thing again, being a form for entering an extraction configuration directly rather than the guided tool.

  3. Question 3

    Which delimiters can the Field Extractor (FX) detect? (Choose all that apply.)
    1. A. Tabs
    2. B. Pipes
    3. C. Spaces
    4. D. Commas
    Explanation

    The correct answers are: A. Tabs, B. Pipes, C. Spaces, D. Commas.

    All four separators are detectable, because delimited mode works on any consistent character rather than a fixed set. Tabs, pipes, spaces, and commas are among the presets the interface offers, and an Other field accepts any character not listed. Detection works by splitting each event on the chosen character and treating the resulting pieces as columns, which is why the tool can preview the split and let you name each field before saving. The requirement is that the separator divide the fields the same way in every event, since a character appearing inside a value as well as between values produces misaligned columns. When data does not meet that condition, whether because separators vary or because values embed the separator, the regular expression method is the alternative.

  4. Question 4

    When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?
    1. A. The regex can no longer be edited.
    2. B. The field being extracted will be required for all future events.
    3. C. The events without the required field will not display in searches.
    4. D. Only events with the required string will be included in the extraction.
    Explanation

    The correct answer is: D. Only events with the required string will be included in the extraction..

    The require option narrows the scope of the extraction itself, so that only events containing the specified string are processed by it. This is a precision and performance feature, letting you confine a pattern to the subset of events it was designed for rather than attempting the match against every event in the sourcetype. It does not lock the regular expression, which remains editable. It does not make the field mandatory for future events, since Splunk imposes no schema on incoming data and an extraction cannot require anything of what gets indexed. And it does not hide events from searches, which is the most tempting misreading: events lacking the required string are still returned by searches as normal, they simply do not have this extraction applied and therefore lack the field it would have produced.

  5. Question 5

    In what order are the following knowledge objects/configurations applied?
    1. A. Field Aliases, Field Extractions, Lookups
    2. B. Field Extractions, Field Aliases, Lookups
    3. C. Field Extractions, Lookups, Field Aliases
    4. D. Lookups, Field Aliases, Field Extractions
    Explanation

    The correct answer is: B. Field Extractions, Field Aliases, Lookups.

    The sequence runs field extractions, then field aliases, then lookups, and this ordering explains most of the dependency rules around these objects. Extraction comes first because it creates fields from the raw event text, so nothing else could operate without it. Aliasing follows, adding alternative names to those extracted fields, which is why an alias can rename an extraction but not the reverse. Lookups come last of the three, which is what makes an aliased name usable as a lookup's match field while leaving lookup output unavailable to anything earlier in the chain. Every other ordering breaks one of those dependencies, since putting aliases before extractions would leave nothing to rename and putting lookups before aliases would prevent using an aliased field to match against a table. The full search-time sequence extends this with calculated fields between aliases and lookups, then event types, then tags.

Other Splunk Core Certified Power User domains

Practice all 21 Creating and Managing Fields questions · Browse Splunk Core Certified Power User