Splunk Exam SPLK-1002 Topic 1 Question 54 Discussion

Actual exam question for Splunk's SPLK-1002 exam

Question #: 54
Topic #: 1

Which of the following searches show a valid use of a macro? (Choose all that apply.)

Aindex=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField

Bindex=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField

Cindex=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField

Dindex=main source=mySource oldField=* | ''newField('makeMyField(oldField)')'' | table _time newField

Show Suggested Answer

Suggested Answer: A, C

by Lashaunda at Jun 28, 2022, 06:50 AM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!