Splunk Exam SPLK-5001 Topic 4 Question 18 Discussion

Actual exam question for Splunk's SPLK-5001 exam

Question #: 18
Topic #: 4

After discovering some events that were missed in an initial investigation, an analyst determines this is because some events have an empty src field. Instead, the required data is often captured in another field called machine_name.

What SPL could they use to find all relevant events across either field until the field extraction is fixed?

A| eval src = coalesce(src,machine_name)

B| eval src = src + machine_name

C| eval src = src . machine_name

D| eval src = tostring(machine_name)

Show Suggested Answer

Suggested Answer: A

by Timothy at Feb 09, 2025, 01:24 PM

Limited Time Offer

25%

Off

Get Premium SPLK-5001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jody

I'm not sure about that. I think option D) | eval src = tostring(machine_name) could also work, converting machine_name to a string.

upvoted 0 times

...

Lucina

17 days ago

Option A looks good, but I'm not sure if it's the most efficient approach. Wouldn't it be better to just use the machine_name field directly instead of trying to combine it with the src field?

upvoted 0 times

...

25 days ago

I think the answer is A) | eval src = coalesce(src,machine_name). It combines the values of src and machine_name.

upvoted 0 times

...