Exam SPLK-1002 topic 1 question 117 discussion

B is correct Explanation: A. There is a limit to the number of fields that can be extracted.: This statement is misleading. While there may be practical limits related to performance, there isn’t a strict predefined limit specifically imposed by the editing of a regex. B. The user is unable to return to the automatic field extraction workflow.: This is true. Once a user edits a regex for manual field extraction, they typically cannot revert back to the automatic extraction configuration that was generated prior to editing. C. The user is unable to preview the extractions.: This statement is false. Users can still preview the field extractions even after editing the regex. D. The extraction is added at index time.: This is false. Field extractions made using the Field Extractor (FX) are generally applied at search time, not at index time.

It't from Field Extractor (FX) "If you manually edit and then preview the regular expression below, you cannot return to the automatic field extraction workflow."

B. The user is unable to return to the automatic field extraction workflow. Manual Editing Impact: According to the Splunk documentation, when a user manually edits the regular expression in the Field Extractor, it takes them out of the automatic field extraction workflow. This is supported by result which states, "You can manually edit the regular expression. However, doing this takes you out of the field extractor workflow. When you save your changes to the field extraction, the field extractor takes you to the final Save step." Preview Limitation: The documentation also mentions that you can only return to the field extractor workflow if you have not yet tried to preview a regular expression change. Once you preview the change, the option to go back is no longer available.

B is answer, tested

Answer A

NO , I suppose it would be B , A is not .. its a typo mistake

Answer is A guys , I verified it at exam .