A custom parking-meter syslog buries the meter ID in the raw message. The analyst needs that ID as a field for later stats. Which command extracts it in the search?
Select an answer to reveal the explanation.
Short Explanation
The meter ID is hiding in the syslog sentence like a ticket number in a paragraph. rex is the highlighter that pulls it into a real field so stats can count. No CIM model is going to guess that custom string.
Full Explanation
In Splunk Enterprise Security for a municipal SOC, rex extracts fields with regular expressions from _raw or another field during search so custom civic sourcetypes become aggregatable. When parking-meter syslog buries the meter ID in the raw message, rex against that message creates a meter ID field that later stats can count—something CIM Authentication will not invent for a non-auth sourcetype. Using tstats on Authentication, which will invent a meter ID from CIM user, fails by concept because Authentication summaries do not contain parking-meter identifiers and will not fabricate them. Using transaction with maxspan=1s, which supposedly splits raw messages into fields automatically, fails by concept because transaction groups events; it does not parse fields from syslog sentences. Looking up a blank table named meter_id without extracting anything from _raw fails by concept because an empty lookup cannot create values that were never extracted. Exam caveat: SPLK-5001 expects rex for search-time extraction of identifiers from custom civic logs before stats. Operational check: develop a rex that extracts meter ID from a sample parking-meter event, run stats count by meter_id for the incident window, spot-check extracted IDs against _raw, and file a request for a durable field extraction if this sourcetype will be used repeatedly.