Splunk Core Certified Power User — Question 206

If there are fields in the data with values that are "" or empty but not null, which of the following would add a value?

Answer options

• A. | eval notNULL="" | fillnull value=0 notNULL
• B. | eval notNULL = "" | nullfill value=0 notNULL
• C. | eval notNULL = if(isnull(notNULL), "0"
• D. | eval notNULL = if(isnull(notNULL), "0", notNULL)

Correct answer: A

Explanation

Option A correctly uses the fillnull command to replace empty fields with a specified value, in this case, 0. Option B uses nullfill, which only addresses null values, and options C and D deal with null conditions rather than empty fields, making them ineffective for this particular scenario.