exam questions

Exam SPLK-1002 All Questions

View all questions & answers for the SPLK-1002 exam

Exam SPLK-1002 topic 1 question 163 discussion

Actual exam question from Splunk's SPLK-1002
Question #: 163
Topic #: 1
[All SPLK-1002 Questions]

What are the expected search results from executing the following SPL command?

index=network NOT StatusCode=200

  • A. No results as the syntax is incorrect, the != field expression needs to be used instead of the NOT operator.
  • B. Every event in the network index that does not contain a StatusCode of 200 and excluding events that do not have a value in this field.
  • C. Every event in the network index that does not contain a StatusCode of 200, including events that do not have a value in this field.
  • D. Every event in the network index that does not have a value in this field.
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
DAL1998
1 month, 1 week ago
Selected Answer: C
Correct, "C"is the good answer. When you want to exclude results from your search you can use the NOT operator or the != field expression. However there is a significant difference in the results that are returned from these two methods. If you search with the != expression, every event that has a value in the field, where that value does not match the value you specify, is returned. Events that do not have a value in the field are not included in the results. If you search with the NOT operator, every event is returned except the events that contain the value you specify. This includes events that do not have a value in the field. Reference: https://docs.splunk.com/Documentation/Splunk/latest/Search/NOTexpressions
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago