nerdexam
Splunk

SPLK-1002 · Question #197

Which of the following expressions could be used to create a calculated field called gigabytes?

The correct answer is B. | eval negabytes=sc_bytes(1024/1024). A valid Splunk eval expression for a calculated field requires the pipe character, the 'eval' keyword, and a proper 'fieldname=expression' assignment.

Creating Field Aliases and Calculated Fields

Question

Which of the following expressions could be used to create a calculated field called gigabytes?

Options

  • Aeval sc_bytes(1024/1024)
  • B| eval negabytes=sc_bytes(1024/1024)
  • Cmegabytes=sc_bytes(1024/1024)
  • Dsc_bytas(1024/1024)

How the community answered

(45 responses)
  • A
    7% (3)
  • B
    89% (40)
  • C
    2% (1)
  • D
    2% (1)

Why each option

A valid Splunk eval expression for a calculated field requires the pipe character, the 'eval' keyword, and a proper 'fieldname=expression' assignment.

Aeval sc_bytes(1024/1024)

Option A omits the pipe character and the equals sign assignment, making 'eval sc_bytes(1024/1024)' syntactically invalid SPL that cannot create a field.

B| eval negabytes=sc_bytes(1024/1024)Correct

Option B uses the correct Splunk eval syntax '| eval fieldname=expression', which is the only syntactically valid structure among the choices for defining a calculated field. This format - a pipe followed by eval, a field name, an equals sign, and an arithmetic expression - is exactly what Splunk requires to evaluate and assign a new field value.

Cmegabytes=sc_bytes(1024/1024)

Option C omits both the pipe character and the 'eval' keyword entirely; a bare 'fieldname=expression' string is not valid SPL and will not be interpreted as a field calculation.

Dsc_bytas(1024/1024)

Option D contains only an arithmetic expression fragment with no pipe, no eval keyword, and no field name assignment, making it completely invalid as an SPL statement.

Concept tested: Splunk eval command syntax for defining calculated fields

Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval

Topics

#eval command#calculated fields#SPL syntax#field creation

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice