When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?
A . The regex can no longer be edited.
B . The field being extracted will be required for all future events.
C . The events without the required field will not display in searches.
D . Only events with the required string will be included in the extraction.

Answer: D

Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments