Given the following eval statement: ...| eval fieldl - if(isnotnull(fieldl),fieldl,0), field2 = if(isnull , "NO-VALUE", fieid2) Which of the following is the equivalent using f ilinull?

A. There is no equivalent expression using f ilinull

B. ... t filinull values=(0,"NO-VALUE") fields=(fieldl,field2)

C. ... I filinull value=0 fieldl I fillnull fields

D. ... I fillnull fieldl I filinull value="NO-VALUE" field2

SplunkSplunk

SPLK-1002 · Question #202

SPLK-1002 Question #202: Real Exam Question with Answer & Explanation

Sign in or unlock SPLK-1002 to reveal the answer and full explanation for question #202. The question stem and answer options stay visible for context.

Creating and Managing Fields

Question

Given the following eval statement: ...| eval fieldl - if(isnotnull(fieldl),fieldl,0), field2 = if(isnull<field2>, "NO-VALUE", fieid2) Which of the following is the equivalent using f ilinull?

Options

AThere is no equivalent expression using f ilinull
B... t filinull values=(0,"NO-VALUE") fields=(fieldl,field2)
C... I filinull value=0 fieldl I fillnull fields
D... I fillnull fieldl I filinull value="NO-VALUE" field2

Unlock SPLK-1002 to see the answer

You've previewed enough free SPLK-1002 questions. Unlock SPLK-1002 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.

Unlock SPLK-1002 - $49.99 / 30 days Sign in

Topics

#fillnull command#eval command#Null value handling#Field manipulation

Full SPLK-1002 Practice Browse All SPLK-1002 Questions