Câu 22: SPLK-2002: Splunk Enterprise Certified Architect

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

1. A. The field was extracted as a private knowledge object.
2. B. The events are tagged as communicate, but are missing the network tag.
3. C. The Typing Queue, which does regular expression replacements, is blocked.
4. D. The colleague did not explicitly use the field in the search and the search was set to Fast Mode. — đáp án hiện tại