In the Field Extractor Utility, this button will display events that do not contain extracted fields. Select your answer.

The Field Extractor (FX) utility in Splunk provides an interface to validate a new field extraction against a sample of events. After defining the extraction pattern, the FX displays events that match the pattern under the "Matches" tab. To review the events from the sample that do not conform to the pattern and therefore will not have the field extracted, the user must click the "Non-Matches" button. This feature is essential for troubleshooting and refining the extraction logic to ensure it is both accurate and comprehensive.

1. Source: Splunk Enterprise Knowledge Manager Manual

Reference: In the section "Use the Field Extractor

" under the subsection "Validate the extraction

" the documentation states: "Click Non-Matches to see a list of events that do not contain the field extraction."

Document: Splunk Enterprise 9.2.1

Knowledge Manager Manual

Part number: SPL-1443.

2. Source: Splunk Education

Splunk Fundamentals 2 Courseware

Reference: In the module covering field extractions

the lab exercises for using the Field Extractor explicitly guide the student to use the "Non-Matches" button to verify which events are being excluded by their regular expression. This step is presented as a critical part of the validation process.

Document: Splunk Enterprise 8.2.0 Fundamentals 2

Student Guide

Module 6: Creating Field Extractions

Page 6-13.