A.The Field Extractor (FX) UI keeps its own version of the field extraction in addition to the one that was manually edited.

B.Changes made manually can be reverted in the Field Extractor (FX) UI.

C.It is not possible to manually edit a regular expression (regex) that was created using the Field Extractor (FX) UI.

D.It is no longer possible to edit the field extraction in the Field Extractor (FX) UI.

A.CIM is a methodology for normalizing data.

B.The Knowledge Manager uses the CIM to create knowledge objects.

C.CIM is ^n app that can coexist with other apps on a single Splunk deployment.

D.CIM can correlate data from different sources.

A.Tags

B.Extracted fields

C.Output fields for a lookup

D.Fields generated from a search string

A.Label, URI, post arguments.

B.XMI attributes, URI, name.

C.Label, URI, search string.

D.URI, search string, time range picker.

A.displays only events that contain a value for user

B.displays all events

C.displays only events that do NOT contain a value for user