Splunk Exam SPLK-1002 Topic 3 Question 106 Discussion

Actual exam question for Splunk's SPLK-1002 exam

Question #: 106
Topic #: 3

[All SPLK-1002 Questions]

Given the following eval statement:

... | eval field1 = if(isnotnull(field1),field1,0), field2 = if(isnull(field2), "NO-VALUE", field2)

Which of the following is the equivalent using fillnull?

A... | fillnull values=(0,'NO-VALUE') fields=(field1,field2)

BThere is no equivalent expression using fillnull

C... | fillnull field1 | fillnull value='NO-VALUE' field2

D... | fillnull value=0 field1 | fillnull field2

Show Suggested Answer

Suggested Answer: D

The fillnull command can be used to replace null values in specific fields. The correct equivalent expression for the given eval statement would involve using fillnull twice, once for field1 to replace null values with 0, and once for field2 to replace null values with 'NO-VALUE'.

Splunk Docs - fillnull command

by Leanna at Jan 22, 2025, 12:19 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1002 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!