Exam SPLK-1002 topic 1 question 131 discussion

I''m guessing by the wording of this question the answer is A. I think D is intended for mvappend. However the answer could still be D because even if productName values are returned first, productID values will also be returned since they're both not null.

A is the correct answer. https://docs.splunk.com/Documentation/SCS/current/SearchReference/EvalFunctionsQuickReference - coalesce(<values>) Takes one or more values and returns the first value that is not NULL.

"You have a set of events where the IP address is extracted to either clientip or ipaddress. This example defines a new field called ip, that takes the value of either the clientip field or ipaddress field, depending on which field is not NULL (does not exist in that event). If both the clientip and ipaddress field exist in the event, this function returns the value in first argument, the clientip field."

D is the correct answer ...check this out https://kinneygroup.com/blog/using-the-coalesce-command/#:~:text=What%20is%20the%20Splunk%20coalesce,them%20together%20in%20another%20field.