ExamGecko
Question list
Search
Search

Question 158 - SPLK-1002 discussion

Report
Export

Which of the following searches show a valid use of a macro? (Choose all that apply.)

A.
index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
Answers
A.
index=main source=mySource oldField=* |'makeMyField(oldField)'| table _time newField
B.
index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
Answers
B.
index=main source=mySource oldField=* | stats if('makeMyField(oldField)') | table _time newField
C.
index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
Answers
C.
index=main source=mySource oldField=* | eval newField='makeMyField(oldField)'| table _time newField
D.
index=main source=mySource oldField=* | ''newField('makeMyField(oldField)')'' | table _time newField
Answers
D.
index=main source=mySource oldField=* | ''newField('makeMyField(oldField)')'' | table _time newField
Suggested answer: A, C

Explanation:

The searches A and C show a valid use of a macro. A macro is a reusable piece of SPL code that can be called by using single quotes (''). A macro can take arguments, which are passed inside parentheses after the macro name. For example, 'makeMyField(oldField)' calls a macro named makeMyField with an argument oldField. The searches B and D are not valid because they use double quotes ('''') instead of single quotes ('').

asked 23/09/2024
Dang Xuan Bao
41 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first