nerdexam
Splunk

SPLK-1002 · Question #245

A user wants to convert numeric field values to strings and also to sort on those values. Which command should be used first, the eval or the sort?

The correct answer is C. Use sort first, then convert the numeric to a string with eval. You should use sort first, then eval to convert to a string (C). Sorting on a numeric field sorts numerically (e.g., 2 < 10 < 100), which is the intended behavior. If you first convert to a string with eval, then sorting becomes lexicographic/alphabetical (e.g., '10' < '2' <…

Basic Transforming Commands

Question

A user wants to convert numeric field values to strings and also to sort on those values. Which command should be used first, the eval or the sort?

Options

  • AIt doesn't matter whether eval or sort is used first.
  • BConvert the numeric to a string with eval first, then sort.
  • CUse sort first, then convert the numeric to a string with eval.
  • DYou cannot use the sort command and the eval command on the same field.

How the community answered

(35 responses)
  • A
    6% (2)
  • B
    11% (4)
  • C
    80% (28)
  • D
    3% (1)

Explanation

You should use sort first, then eval to convert to a string (C). Sorting on a numeric field sorts numerically (e.g., 2 < 10 < 100), which is the intended behavior. If you first convert to a string with eval, then sorting becomes lexicographic/alphabetical (e.g., '10' < '2' < '100'), which is almost certainly not the desired result. The pipeline order matters: | sort numericField | eval numericField=tostring(numericField) preserves correct numeric ordering.

Topics

#eval command#sort command#data type conversion#command order of operations

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice