Exam C1000-162 Topic 1 Question 139 Discussion

Actual exam question for IBM's C1000-162 exam
Question #: 139
Topic #: 1
How do events appear in QRadar if there was an error in the JSON parser for a new log source to which a custom log source extension was created?

Suggested Answer: D Vote an answer

* Parsing Failure: A JSON parser error implies QRadar couldn't correctly extract structured data from the raw log messages created by the custom extension.
* Fallback - CRE: QRadar defaults to storing unparseable events as CRE, preserving the raw log message but losing structured fields.
* Troubleshooting: CRE events indicate the need to fix the log source extension's JSON parsing.

by Priscilla at Jan 19, 2026, 11:59 PM

Limited Time Offer

15%

Off

Get Premium C1000-162 Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10