Splunk Exam SPLK-1002 Topic 8 Question 68 Discussion

Actual exam question for Splunk's SPLK-1002 exam

Question #: 68
Topic #: 8

What are the expected search results from executing the following SPL command?

index=network NOT StatusCode=200

AEvery event in the network index that does not have a value in this field.

BEvery event in the network index that does not contain a StatusCode of 200 and excluding events that do not have a value in this field.

CEvery event in the network index that does not contain a StatusCode of 200, including events that do not have a value in this field.

DNo results as the syntax is incorrect, the != field expression needs to be used instead of the NOT operator.

Show Suggested Answer

Suggested Answer: C

by Dominque at Apr 01, 2023, 04:08 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1002 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Shanice

2 months ago

Hmm, tough one. I'm leaning towards C, but I also kind of want to pick D just to see the look on the instructor's face when they realize the syntax is actually correct. Decisions, decisions.

upvoted 0 times

...

Mee

2 months ago

I'm going with C. The question specifically says 'including events that do not have a value in this field', so that's the only option that matches.

upvoted 0 times

...

Virgilio

2 months ago

Ha! D is clearly the winner here. Whoever wrote this question must be a Splunk newbie. Everyone knows you use != for field exclusions, not the NOT operator.

upvoted 0 times

Nancey

21 days ago

Definitely D. The correct syntax for excluding fields is using !=, not the NOT operator.

upvoted 0 times

...

Irma

1 months ago

I think D is the best option here. The syntax needs to be corrected to use != instead of NOT.

upvoted 0 times

...

Sharee

1 months ago

Yeah, D is definitely the right choice. The NOT operator is not used for excluding fields.

upvoted 0 times

...

Lorrine

1 months ago

I agree, D is the correct answer. The syntax should use != for field exclusions.

upvoted 0 times

...

Marti

2 months ago

I think B is the right answer. The NOT operator should exclude events without a StatusCode value.

upvoted 0 times

Evette

1 months ago

B is the most logical choice, it excludes StatusCode 200 events and those without a value.

upvoted 0 times

...

Tawanna

2 months ago

I think it's B too, excluding events without a StatusCode value makes sense.

upvoted 0 times

...

Ashleigh

2 months ago

I agree, B seems like the correct answer.

upvoted 0 times

...

Shanice

3 months ago

I'm not sure, but I think D) No results as the syntax is incorrect, the != field expression needs to be used instead of the NOT operator.

upvoted 0 times

...

Lavera

3 months ago

I agree with Malcolm, because NOT excludes events with a specific value, while != excludes events with any value.

upvoted 0 times

...

Malcolm

3 months ago

I think the answer is B) Every event in the network index that does not contain a StatusCode of 200 and excluding events that do not have a value in this field.

upvoted 0 times

...

Jess

3 months ago

The correct answer is C. The NOT operator will include events that do not have a value in the StatusCode field, which is what the question is asking for.

upvoted 0 times

Erick

3 months ago

Actually, the correct answer is C.

upvoted 0 times

...

Adela

3 months ago

I think the answer is B.

upvoted 0 times

...