Exam SPLK-1002 topic 1 question 148 discussion

The correct answer is: D. `| eval notNULL = if(isnull(notNULL), "0", notNULL)`** Explanation:`isnull(field)` checks if a field is truly `null` — not just empty (`""`), but non-existent or undefined. Splunk treats `""` (empty string) as not null**, so options using `isnull()` won't affect them. Evaluating each option: A. `| eval notNULL="" | fillnull value=0 notNULL`** `fillnull` only replaces **null** values, not empty strings (`""`). This sets `notNULL` to an empty string, then tries to replace nulls (which aren't present anymore) — ineffective. B. `| eval notNULL = "" | nullfill value=0 notNULL`** `nullfill` is **not a valid Splunk command**. Invalid syntax. C. `| eval notNULL = if(isnull(notNULL), "0"`** Incomplete statement — syntax error (missing closing parenthesis and `else` clause).

…|fillnull [value=<stirng>][field-list>] A is correct

The correct answer is D. | eval notNULL = "" fillnull value=0 notNULL Option A is incorrect because it is missing a comma between the "0" and the notNULL in the if function. The correct syntax for the if function is if (condition, true_value, false_value). Option B is incorrect because it is missing the false_value argument in the if function. The correct syntax for the if function is if (condition, true_value, false_value). Option C is incorrect because it uses the nullfill command, which only replaces null values, not empty strings. The nullfill command is equivalent to fillnull value=null. Option D is correct because it uses the eval command to assign an empty string to the notNULL field, and then uses the fillnull command to replace the empty string with a zero. The fillnull command can replace any value with a specified replacement, not just null values.