Given the following eval statement:.

Splunk SPLK-1002 Question Answer

Given the following eval statement:

... | eval field1 = if(isnotnull(field1),field1,0), field2 = if(isnull(field2), "NO-VALUE", field2)

Which of the following is the equivalent using fillnull?

... | fillnull values=(0,"NO-VALUE") fields=(field1,field2)

There is no equivalent expression using fillnull

... | fillnull field1 | fillnull value="NO-VALUE" field2

... | fillnull value=0 field1 | fillnull field2

SPLK-1002 PDF/Engine

Get 65% Discount on All Products, Use Coupon: "ac4s65"