MENU
Given the following eval statement:
... | eval field1 = if(isnotnull(field1),field1,0), field2 = if(isnull(field2), "NO-VALUE", field2)
Which of the following is the equivalent using fillnull?
Suggested Answer: D
Get Premium SPLK-1002 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The fillnull command can be used to replace null values in specific fields. The correct equivalent expression for the given eval statement would involve using fillnull twice, once for field1 to replace null values with 0, and once for field2 to replace null values with 'NO-VALUE'.
Splunk Docs - fillnull command
30 comments · newest first
CE
Celia
10 months ago
D doesn't seem to cover both fields properly.
BI
Billi
11 months ago
Wait, can fillnull really handle multiple fields like that?
AU
Audra
11 months ago
C seems like a valid approach too!
JE
Jettie
11 months ago
I think B is correct, no equivalent exists.
TR
Truman
11 months ago
Option A looks right to me.
QU
Quinn
12 months ago
I'm leaning towards option D, but I wonder if it really captures both conditions from the eval statement correctly.
HY
Hyun
12 months ago
I feel like we had a similar question in practice where we had to determine the best use of fillnull, but I can't remember the exact details.
KA
Kami
12 months ago
I think option C might be the right approach since it uses fillnull for each field separately, but I can't recall if that's the best practice.
FR
Frederick
1 year ago
I remember we discussed how fillnull can be used to replace null values, but I'm not sure if it can handle multiple fields at once like in option A.
LA
Lai
1 year ago
I've got a good feeling about option A. The fillnull statement is setting both fields to the specified values, which seems to match the logic in the eval statement. I'll go with that unless I spot something I'm missing.
ED
Edelmira
1 year ago
I'm a bit confused on this one. The eval statement is doing some complex logic, and I'm not sure if any of the fillnull options can fully replicate that. I may need to double-check the fillnull documentation to see if there's a way to achieve the same result.
AN
Andrew
1 year ago
Okay, I think option C is the right answer here. The fillnull statement is doing the same thing as the eval statement - setting field1 to 0 if it's null, and field2 to "NO-VALUE" if it's null.
LA
Laquita
1 year ago
Hmm, the eval statement is doing two different things - setting field1 to 0 if it's null, and setting field2 to "NO-VALUE" if it's null. I'll need to find an equivalent fillnull expression that can handle both of those cases.
AL
Alaine
1 year ago
This looks like a tricky one. I'll need to carefully compare the eval statement to the fillnull options to see which one matches.
JE
Jettie
2 years ago
I think the answer is B, there is no equivalent expression using fillnull.
NO
Nobuko
2 years ago
I'm not sure, but I think the answer might be D.
IR
Irma
2 years ago
Haha, I guess the exam writer is trying to trip us up with these tricky eval statements. But option A seems legit to me.
DO
Domitila
2 years ago
User1: Let's go with option A then, it seems like the most logical choice.
LE
Lea
2 years ago
User3: I'm not so sure, but it does make sense to use fillnull with values and fields like in option A.
KE
Kenneth
2 years ago
User2: Yeah, I think so too. It fills null values for both field1 and field2 with the specified values.
FL
Fletcher
2 years ago
User1: I agree, option A looks like the equivalent using fillnull.
VI
Vilma
2 years ago
I disagree, I believe the answer is C.
EU
Eugene
2 years ago
I think the answer is A.
ER
Ernest
2 years ago
I think option D is the way to go. Separate fillnull commands for each field seems cleaner and more explicit.
KA
Karrie
2 years ago
I think option D is the best choice as well. It makes the logic more explicit.
MA
Marya
2 years ago
I agree, using separate fillnull commands for each field does seem cleaner.
KI
Kimi
2 years ago
Option A looks like the correct equivalent to me. It fills null values with the specified values for the respective fields.
LA
Lashonda
2 years ago
User3: Yes, option A looks like the best match for the given eval statement.
RO
Romana
2 years ago
User2: I agree, option A seems to be the most appropriate choice.
MI
Mirta
2 years ago
User1: I think option A is the correct equivalent. It fills null values with the specified values for the respective fields.