SPLK-5001 · Question #72
After discovering some events that were missed in an initial investigation, an analyst determines this is because some events have an empty src field. Instead, the required data is often captured in a
Sign in or unlock SPLK-5001 to reveal the answer and full explanation for question #72. The question stem and answer options stay visible for context.
Question
After discovering some events that were missed in an initial investigation, an analyst determines this is because some events have an empty src field. Instead, the required data is often captured in another field called machine_name. What SPL could they use to find all relevant events across either field until the field extraction is fixed?
Options
- A| eval src = coalesce(src,machine_name)
- B| eval src = src + machine_name
- C| eval src = src . machine_name
- D| eval src = tostring(machine_name)
Unlock SPLK-5001 to see the answer
You've previewed enough free SPLK-5001 questions. Unlock SPLK-5001 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.