What does the fillnull command do in this search? index=main sourcetype=http_log | fillnull value="Unknown" src

The correct answer is C. Set the values of the src field to "Unknown" if it is null. The fillnull command in Splunk is used to replace null (missing) field values with a specified value.

Creating and Managing Fields

Question

Options

ASet the values of the src field to null when it is "Unknown".
BSet all fields with the value of "Unknown" to null.
CSet the values of the src field to "Unknown" if it is null.
DSet all fields that are null to "Unknown".

How the community answered

(47 responses)

A
2% (1)
B
2% (1)
C
87% (41)
D
9% (4)

Explanation

The fillnull command in Splunk is used to replace null (missing) field values with a specified value.

Topics

#fillnull command#field manipulation#missing data#data cleaning

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice