nerdexam
Splunk

SPLK-1002 · Question #202

Given the following eval statement: ...| eval fieldl - if(isnotnull(fieldl),fieldl,0), field2 = if(isnull<field2>, "NO-VALUE", fieid2) Which of the following is the equivalent using f ilinull?

The correct answer is B. ... t filinull values=(0,"NO-VALUE") fields=(fieldl,field2). The fillnull command replaces null values in one or more fields with a specified value. The values option allows you to specify a comma-separated list of values to fill the null values in the corresponding fields. The fields option allows you to specify a comma-separated list…

Creating and Managing Fields

Question

Given the following eval statement:

...| eval fieldl - if(isnotnull(fieldl),fieldl,0), field2 = if(isnull<field2>, "NO-VALUE", fieid2) Which of the following is the equivalent using f ilinull?

Options

  • AThere is no equivalent expression using f ilinull
  • B... t filinull values=(0,"NO-VALUE") fields=(fieldl,field2)
  • C... I filinull value=0 fieldl I fillnull fields
  • D... I fillnull fieldl I filinull value="NO-VALUE" field2

How the community answered

(36 responses)
  • A
    14% (5)
  • B
    75% (27)
  • C
    3% (1)
  • D
    8% (3)

Explanation

The fillnull command replaces null values in one or more fields with a specified value. The values option allows you to specify a comma-separated list of values to fill the null values in the corresponding fields. The fields option allows you to specify a comma-separated list of fields to apply the fillnull command to. The eval statement in the question uses the if and isnull functions to check if field1 and field2 have null values and replace them with 0 and "NO-VALUE" respectively. The equivalent expression using fillnull is to use the values option to specify 0 and "NO-VALUE" and the fields option to specify field1 and field.

Topics

#fillnull command#eval command#Null value handling#Field manipulation

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice