フリー問題

Splunk Core Certified Power User のフリー問題 5 / 20 問目

問題文

A single pipeline needs to add a field holding the elapsed seconds and another field holding a label derived from the status code. The team wants to avoid repeating the command. Which approach matches how eval accepts more than one assignment?

選択肢

  1. Write both assignments in one eval, separating them with a pipe character, because each assignment is treated as its own stage of the pipeline.
  2. Use fillnull for the second field and a separate second eval command, because eval accepts only one assignment.
  3. Write both assignments in one eval, separating them with a comma, because eval accepts several assignments in a single invocation.
  4. Write the two assignments in one eval separated by a space, because eval reads each assignment as a separate term the way the search command reads its terms.

解答・解説を確認するには

正解と解説の確認、回答の記録には無料登録が必要です。登録すると演習モードでフリー問題に回答し、正誤と解説をその場で確認できます。