Where does the regex replacement processor run?

Where does the regex replacement processor run?
A . Merging pipeline
B . Typing pipeline
C . Index pipeline
D . Parsing pipeline

View Answer

Answer: D

Explanation:

The regex replacement processor is part of the parsing stage in Splunk’s data ingestion pipeline. This stage is responsible for handling data transformations, which include applying regex replacements. D. Parsing pipeline is the correct answer. The parsing pipeline is where initial data transformations, including regex replacement, occur before the data is indexed. This stage processes events as they are parsed from raw data, including applying any regex-based modifications. Splunk Documentation

Reference: Data Processing Pipelines in Splunk