Splunk Core Certified Power User — Question 131

Which of the following eval commands will provide a new value for host from src if it exists?

Answer options

• A. | eval host * if(isnull(src), src, host)
• B. | eval host = if(src = host, src, host)
• C. | eval host = if(NOT src = host, src, host)
• D. | eval host = if(isnotnull(src), src, host)

Correct answer: D

Explanation

The correct answer D works because it checks if src is not null and assigns its value to host if true. Option A incorrectly uses '*' instead of '=', and does not provide the desired functionality. Option B compares src to host rather than checking if src is null, while option C uses a negation that does not meet the requirement.