SplunkSplunk
SPLK-1002 · Question #297
SPLK-1002 Question #297: Real Exam Question with Answer & Explanation
The correct answer is C: Set the values of the src field to "Unknown" if it is null.. The fillnull command in Splunk is used to replace null (missing) field values with a specified value.
Creating and Managing Fields
Question
What does the fillnull command do in this search? index=main sourcetype=http_log | fillnull value="Unknown" src
Options
- ASet the values of the src field to null when it is "Unknown".
- BSet all fields with the value of "Unknown" to null.
- CSet the values of the src field to "Unknown" if it is null.
- DSet all fields that are null to "Unknown".
Explanation
The fillnull command in Splunk is used to replace null (missing) field values with a specified value.
Topics
#fillnull command#field manipulation#missing data#data cleaning
Community Discussion
No community discussion yet for this question.