Splunk Infrastructure Overview — Question 16

How is a multivalue field created from product="a,b,c,d"?

Answer options

• A. ...| makemv delim(product, ",")
• B. ...| eval mvexpand(makemv(product, ","))
• C. ...| mvexpand product
• D. ...| makemv delim="," product

Correct answer: D

Explanation

The correct answer is D, as it properly uses the 'makemv' command with the specified delimiter to create a multivalue field from the product string. Option A is incorrect because it improperly uses 'delim' as a function instead of a parameter. Option B incorrectly tries to expand the multivalue field at the same time as creating it, which is not the correct sequence. Option C does not create the multivalue field; it only expands an existing one.