SPLK-1002 · Question #197
Which of the following expressions could be used to create a calculated field called gigabytes?
The correct answer is B. | eval negabytes=sc_bytes(1024/1024). A valid Splunk eval expression for a calculated field requires the pipe character, the 'eval' keyword, and a proper 'fieldname=expression' assignment.
Question
Which of the following expressions could be used to create a calculated field called gigabytes?
Options
- Aeval sc_bytes(1024/1024)
- B| eval negabytes=sc_bytes(1024/1024)
- Cmegabytes=sc_bytes(1024/1024)
- Dsc_bytas(1024/1024)
How the community answered
(45 responses)- A7% (3)
- B89% (40)
- C2% (1)
- D2% (1)
Why each option
A valid Splunk eval expression for a calculated field requires the pipe character, the 'eval' keyword, and a proper 'fieldname=expression' assignment.
Option A omits the pipe character and the equals sign assignment, making 'eval sc_bytes(1024/1024)' syntactically invalid SPL that cannot create a field.
Option B uses the correct Splunk eval syntax '| eval fieldname=expression', which is the only syntactically valid structure among the choices for defining a calculated field. This format - a pipe followed by eval, a field name, an equals sign, and an arithmetic expression - is exactly what Splunk requires to evaluate and assign a new field value.
Option C omits both the pipe character and the 'eval' keyword entirely; a bare 'fieldname=expression' string is not valid SPL and will not be interpreted as a field calculation.
Option D contains only an arithmetic expression fragment with no pipe, no eval keyword, and no field name assignment, making it completely invalid as an SPL statement.
Concept tested: Splunk eval command syntax for defining calculated fields
Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval
Topics
Community Discussion
No community discussion yet for this question.