Splunk Core Certified Power User — Question 151

Which of the following expressions could be used to create a calculated field called megabytes?

Answer options

• A. eval sc_bytes(1024/1024)
• B. sc_bytes(1024/1024)
• C. | eval megabytes=sc_bytes(1024/1024)
• D. megabytes=sc_bytes(1024/1024)

Correct answer: C

Explanation

The correct answer is C because it properly uses the 'eval' command to create a new field named 'megabytes' that calculates its value based on 'sc_bytes(1024/1024)'. Option A is incorrect because it does not assign the result to a field, while B simply calls the function without any assignment. Option D incorrectly assigns the result directly to 'megabytes' without using the 'eval' command.