nerdexam
Splunk

SPLK-1001 · Question #199

What syntax is used to link key/value pairs in search strings?

The correct answer is B. action=purchase. Option B (action=purchase) is correct because the equals sign (=) is the standard syntax for linking a key to its value in search strings, query parameters, and many query languages (e.g., URL query strings like ?action=purchase, Splunk searches, log filtering tools). Option A…

Question

What syntax is used to link key/value pairs in search strings?

Options

  • Aaction+purchase
  • Baction=purchase
  • Caction | purchase
  • Daction equal purchase

How the community answered

(30 responses)
  • A
    10% (3)
  • B
    80% (24)
  • C
    7% (2)
  • D
    3% (1)

Explanation

Option B (action=purchase) is correct because the equals sign (=) is the standard syntax for linking a key to its value in search strings, query parameters, and many query languages (e.g., URL query strings like ?action=purchase, Splunk searches, log filtering tools). Option A (action+purchase) uses a plus sign, which in URL encoding represents a space character, not a key/value separator. Option C (action | purchase) uses a pipe, which typically means OR or a pipeline between commands, not assignment. Option D (action equal purchase) is plain English - not valid syntax in any search language.

Memory tip: Think of = as "equals" in math - you're saying the key equals that value. key=value reads naturally as an assignment, just like x = 5 in code.

Community Discussion

No community discussion yet for this question.

Full SPLK-1001 Practice