Splunk SPLK-1002 Exam - Topic 1 Question 116 Discussion

Actual exam question for Splunk's SPLK-1002 exam

Question #: 116
Topic #: 1

Which syntax will find events where the values for the 1 field match the values for the Renewal-MonthYear field?

| where 10yearAnnerversary=Renewal-MonthYear

| where '10yearAnnerversary=Renewal-MonthYear

| where 10yearAnnerversary='Renewal-MonthYear'

| where '10yearAnnerversary'='Renewal-MonthYear'

A| where 10yearAnnerversary=Renewal-MonthYear.
The where command is used to filter the search results based on an expression that evaluates to true or false. The where command can compare two fields, two values, or a field and a value. The where command can also use functions, operators, and wildcards to create complex expressions1.
The syntax for the where command is:
| where <expression>
The expression can be a comparison, a calculation, a logical operation, or a combination of these. The expression must evaluate to true or false for each event.
To compare two fields with the where command, you need to use the field names without any quotation marks. For example, if you want to find events where the values for the 10yearAnnerversary field match the values for the Renewal-MonthYear field, you can use the following syntax:
| where 10yearAnnerversary=Renewal-MonthYear
This will return only the events where the two fields have the same value.
The other options are not correct because they use quotation marks around the field names, which will cause the where command to interpret them as string values instead of field names. For example, if you use:
| where '10yearAnnerversary'='Renewal-MonthYear'
This will return no events because there are no events where the string value '10yearAnnerversary' is equal to the string value 'Renewal-MonthYear'.

Show Suggested Answer

Suggested Answer: A

The correct answer is

where command usage

by Izetta at Aug 18, 2025, 05:46 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1002 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Chauncey

4 months ago

Yup, no quotes for field names! That's how it works.

upvoted 0 times

...

Twanna

4 months ago

Wait, are you sure? I thought quotes were sometimes needed.

upvoted 0 times

...

Ashlee

4 months ago

The correct syntax is | where 10yearAnnerversary=Renewal-MonthYear.

upvoted 0 times

...

Corazon

4 months ago

Totally agree, the quotes mess it up!

upvoted 0 times

...

Amos

4 months ago

Good to know! I always get confused with the syntax rules.

upvoted 0 times

...

Chantell

5 months ago

I’m a bit confused. I thought using quotes was okay sometimes, but now I’m not so sure. I’ll go with option A, but I hope I’m right!

upvoted 0 times

...

Margart

5 months ago

I feel like I've seen a similar question before, and it was definitely about not using quotes for field names. So, I think it's option A.

upvoted 0 times

...

Loreta

5 months ago

I'm not entirely sure, but I remember something about quotes making it a string value. So, I guess the first option is right?

upvoted 0 times

...

Jaime

5 months ago

I think the correct syntax is the first one, where you don't use quotes around the field names. That seems to be what we practiced in class.

upvoted 0 times

...

Sharita

5 months ago

The first option makes the most sense to me - comparing the two field names directly without quotes. That should give me the events I need.

upvoted 0 times

...

Fatima

6 months ago

I'm not sure about this one, the different syntax options are throwing me off a bit. I'll have to think it through carefully.

upvoted 0 times

...

Benedict

6 months ago

The key is to use the field names directly without any quotes. The first option looks like the right approach to me.

upvoted 0 times

...

Lavera

6 months ago

Hmm, I'm a bit confused about the use of quotation marks here. Do I need to wrap the field names in quotes or not?

upvoted 0 times

...

Samira

6 months ago

This looks straightforward, I think the first option is the correct syntax to compare the two fields.

upvoted 0 times

...

Anna

7 months ago

I agree with Norah. The where command compares two fields without quotation marks.

upvoted 0 times

...

Oretha

7 months ago

Hmm, I was thinking the third option would work, but you're right, the quotes around the field names don't make sense here. Good catch!

upvoted 0 times

Laine

3 months ago

Agreed! No quotes for field names!

upvoted 0 times

...

Ozell

3 months ago

The first option is definitely the way to go.

upvoted 0 times

...

Renea

3 months ago

Yeah, they really confuse the command.

upvoted 0 times

...

Nana

3 months ago

I thought the quotes were necessary too!

upvoted 0 times

...

Laurena

8 months ago

I agree, the first option is the way to go. Keeping it simple and straightforward is usually the best approach.

upvoted 0 times

...

Norah

8 months ago

I think the correct syntax is | where 10yearAnnerversary=Renewal-MonthYear.

upvoted 0 times

...

Arlyne

8 months ago

The first option is the correct syntax. You don't need quotes around the field names when comparing them in the where command.

upvoted 0 times

...