Which Field Extractor method extracts a port number from an event?
Which method in the Field Extractor would extract the port number from the following event? 10/20/2022 - 125.24.20.1 ++++ port 54 - user: admin
Community Votes
67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The trap is confusing the Field Extractor's built-in methods (Delimiter vs Regular expression) with the rex command, which is a separate SPL command, not a Field Extractor method.
The Field Extractor's correct method for extracting a port number from an event is Regular expression, as confirmed by community consensus. The question specifically asks for the method within the Field Extractor tool, not a SPL command like rex.
Selecting D (rex command) because rex can extract fields using regex, but the question asks for the method in the Field Extractor, making the rex command out of scope.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The Field Extractor in Splunk offers two methods: Delimiter and Regular expression. The event '10/20/2022 - 125.24.20.1 ++++ port 54 - user: admin' has inconsistent delimiters (spaces, hyphens, plus signs) that make delimiter-based extraction unreliable. A regular expression like port (\d+) directly matches the port number, making C the correct choice. Comment [1] highlights this by noting the question asks for a 'method' provided by the Field Extractor.
Why the Other Options Are Wrong
A (Delimiter) fails because no consistent delimiter separates the port field from the rest of the event. B is incorrect because the Field Extractor absolutely supports regular expressions—that is one of its core methods. D (rex command) is a SPL command used in search, not a method within the Field Extractor UI; comment [2] mistakenly focuses on command syntax rather than the tool's built-in methods. The question wording 'method in the Field Extractor' rules out the rex command.
Community Comment Notes
The vote distribution (C: 67, D: 33) shows a clear majority for C, supporting the official answer. Comment [1] directly addresses the wording and votes for C. Comment [2] incorrectly chooses D by demonstrating the rex command, but this misses the context of the Field Extractor tool. Comment [3] simply agrees with C. The community consensus aligns with the suggested answer and the exam's intent to test knowledge of Field Extractor methods.
Official Reference
Exam Strategy
When a question mentions 'in the Field Extractor', focus only on the methods available inside that tool (Delimiter and Regular expression) and ignore commands like rex. Look for clues in the event format—if delimiters vary, choose Regular expression.
Related Analysis
Practice All SPLK-1002 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SPLK-1002 Practice Test →