Exam SPLK-1005 topic 1 question 17 discussion

Please disregard my previous selection. I confirmed that the right option is B. If possible, please remove my previous comment. Link: https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platform-the-Masa/m-p/590774

The Parsing pipeline is responsible for processing raw data before indexing, including: -Breaking raw data into individual events -Applying transforms.conf rules (such as regex replacements) -Extracting timestamps and metadata Why not the other options? A. Merging pipeline – Used for handling multi-line events (e.g., stack traces) but does not process regex replacements. B. Typing pipeline – Handles event categorization and schema application (e.g., field extraction for search-time operations), but regex replacement happens earlier. C. Index pipeline – This is where events are stored, but modifications must happen before indexing. So, D. Parsing pipeline is the correct answer.

Typing pipeline is correct. Go to Monitoring Console /app/splunk_monitoring_console/indexing_performance_instance and look at the visualisation "Splunk Enterprise Data Pipeline"

regex replacement occurs in typing pipeline.