What Happens When You Edit Regex in Splunk Field Extractor?

SPLK-1002 By islever Editorial Last updated

Short answer

B The user is unable to return to the automatic field extraction workflow.

Question

What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?
  1. There is a limit to the number of fields that can be extracted.
  2. The user is unable to return to the automatic field extraction workflow. Correct Answer
  3. The user is unable to preview the extractions.
  4. The extraction is added at index time.

Key Takeaways

The question tests whether you know that manually editing a regex in FX permanently exits the guided automatic workflow, a common trap for those who confuse field limits or indexing behavior.

Editing the regular expression in Splunk's Field Extractor (FX) prevents you from returning to the automatic field extraction workflow. The community consensus strongly supports answer B, despite a minority vote for A.

Common mistake: Choosing A ('There is a limit to the number of fields that can be extracted') is the top wrong answer, likely due to confusion with performance limits or other Splunk constraints, but no such limit is imposed by editing a regex.

Expert Analysis

Why the Answer Is Correct

Option B is correct because Splunk's Field Extractor documentation explicitly states that manually editing the regular expression takes you out of the automatic field extraction workflow. This is a deliberate design: once you switch to manual regex editing, FX assumes you want full control and disables the guided workflow. Comments [1], [2], and [5] all cite or reference that specific documentation language, and multiple users confirm they saw this on the exam.

Why the Other Options Are Wrong

Option A is incorrect because there is no strict predefined field limit triggered by editing a regex; while practical performance limits may exist, they are not part of this behavior. Option C is wrong because you can still preview extractions after editing—the manual edit mode actually retains preview functionality. Option D is incorrect because field extractions are applied at search time, not index time, unless you explicitly use indexed extractions, which is unrelated to FX regex editing.

Community Comment Notes

Most comments (73 votes vs 27) support B, with several stating they "tested" it, such as comment [6]. One comment [4] claims A was verified at the exam, but this contradicts the documented behavior and the majority consensus. Comment [3] dismisses A as a typo, and comment [5] provides the direct quote from Splunk docs: 'If you manually edit and then preview the regular expression below, you cannot return to the automatic field extraction workflow.'

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

In the SPLK-1002 exam, remember that the Field Extractor (FX) has two modes: automatic and manual. If a question asks about the consequences of editing the regex, the correct answer is almost always that the automatic workflow can no longer be resumed, so look for that phrasing and avoid distractors about limits or index-time processing.

Community Votes

B
73%
A
27%

73% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. ismailwale 👍 2 Answered B
    B is correct Explanation: A. There is a limit to the number of fields that can be extracted.: This statement is misleading. While there may be practical limits related to performance, there isn’t a strict predefined limit specifically imposed by the editing of a regex. B. The user is unable to return to the automatic field extraction workflow.: This is true. Once a user edits a regex for manual field extraction, they typically cannot revert back to the automatic extraction configuration that was generated prior to editing. C. The user is unable to preview the extractions.: This statement is false. Users can still preview the field extractions even after editing the regex. D. The extraction is added at index time.: This is false. Field extractions made using the Field Extractor (FX) are generally applied at search time, not at index time.
  2. freeolive_guru 👍 2
    B. The user is unable to return to the automatic field extraction workflow. Manual Editing Impact: According to the Splunk documentation, when a user manually edits the regular expression in the Field Extractor, it takes them out of the automatic field extraction workflow. This is supported by result which states, "You can manually edit the regular expression. However, doing this takes you out of the field extractor workflow. When you save your changes to the field extraction, the field extractor takes you to the final Save step." Preview Limitation: The documentation also mentions that you can only return to the field extractor workflow if you have not yet tried to preview a regular expression change. Once you preview the change, the option to go back is no longer available.
  3. MartinCaplan 👍 2 Answered B
    NO , I suppose it would be B , A is not .. its a typo mistake
  4. MartinCaplan 👍 2 Answered A
    Answer is A guys , I verified it at exam .
  5. PeManSen 👍 1 Answered B
    It't from Field Extractor (FX) "If you manually edit and then preview the regular expression below, you cannot return to the automatic field extraction workflow."
Show 2 more comments
  1. SnakeTech 👍 3 Answered B
    B is answer, tested
  2. MShubo 👍 1 Answered A
    Answer A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Filter Events by Tag and Field in Splunk

S-grade

Which eval operator concatenates a string and a number in Splunk?

S-grade

Which Field Extractor method extracts a port number from an event?

S-grade

How to Pass Arguments to a Nested Macro in Splunk?

S-grade

Practice All SPLK-1002 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SPLK-1002 Practice Test →

← Back to SPLK-1002 Study Guide