nerdexam
Splunk

SPLK-1002 · Question #177

If there are fields in the data with values that are " " or empty but not null, which of the following would add a value?

The correct answer is D. | eval notNULL = "" fillnull value=0 notNULL. Option A is incorrect because it is missing a comma between the "0" and the notNULL in the if function. The correct syntax for the if function is if (condition, true_value, false_value). Option B is incorrect because it is missing the false_value argument in the if function…

Creating and Managing Fields

Question

If there are fields in the data with values that are " " or empty but not null, which of the following would add a value?

Options

  • A| eval notNULL = if(isnull (notNULL), "0" notNULL)
  • B| eval notNULL = if(isnull (notNULL), "0"
  • C| eval notNULL = "" | nullfill value=0 notNULL
  • D| eval notNULL = "" fillnull value=0 notNULL

How the community answered

(30 responses)
  • A
    13% (4)
  • B
    3% (1)
  • C
    7% (2)
  • D
    77% (23)

Explanation

Option A is incorrect because it is missing a comma between the "0" and the notNULL in the if function. The correct syntax for the if function is if (condition, true_value, false_value). Option B is incorrect because it is missing the false_value argument in the if function. The correct syntax for the if function is if (condition, true_value, false_value). Option C is incorrect because it uses the nullfill command, which only replaces null values, not empty strings. The nullfill command is equivalent to fillnull value=null. Option D is correct because it uses the eval command to assign an empty string to the notNULL field, and then uses the fillnull command to replace the empty string with a zero. The fillnull command can replace any value with a specified replacement, not just null values.

Topics

#fillnull command#eval command#empty field values#field manipulation

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice