splk-1002 question 178 discussion

View all Splunk Core Certified Power User Exam here
back to splunk forum

Question 178

Which of the following searches show a valid use of a macro? (Choose all that apply.)

  • A. index=main source=mySource oldField=* |’makeMyField(oldField)’| table _time newField
  • B. index=main source=mySource oldField=* | stats if(makeMyField(oldField)) | table _time newField
  • C. index=main source=mySource oldField=* | eval newField=makeMyField(oldField)| table _time newField
  • D. index=main source=mySource oldField=* | "newField(makeMyField(oldField))" | table _time newField
Answer:

AC

User Votes:
A 3 votes
50%
B
50%
C 2 votes
50%
D
50%
Discussions
0 / 1000
giovanni.zago
1 month, 1 week ago

C doesn't have back ticks, Splunk would not even know it's a macro

0