exam questions

Exam SPLK-1001 All Questions

View all questions & answers for the SPLK-1001 exam

Exam SPLK-1001 topic 1 question 165 discussion

Actual exam question from Splunk's SPLK-1001
Question #: 165
Topic #: 1
[All SPLK-1001 Questions]

NOT status = 100:

  • A. Will display result depending on the data.
  • B. Will return event where status field exist but value of that field is not 100.
  • C. Will return event where status field exist but value of that field is not 100 and all events where status field doesn't exist.
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Rider2053
3 weeks, 3 days ago
C is right answer
upvoted 1 times
...
MF55
4 months, 2 weeks ago
Selected Answer: C
"If you search with the NOT operator, every event is returned except the events that contain the value you specify. This includes events that do not have a value in the field."
upvoted 2 times
...
kiki533
7 months, 1 week ago
Selected Answer: C
C is correct
upvoted 2 times
...
sborisv
11 months, 2 weeks ago
B is correct
upvoted 1 times
...
Steve2610
11 months, 2 weeks ago
Selected Answer: C
NOT status=100 mean, if the event doesn't have a field status, it will match.
upvoted 3 times
...
arcsw
12 months ago
Selected Answer: B
It's B, try it on your instance, also C is not correct because your excluding a value not the field itself and A it´s not applicable because everything dependes on data
upvoted 1 times
...
mku
1 year, 9 months ago
C is correct. https://docs.splunk.com/Documentation/Splunk/8.2.2/Search/NOTexpressions
upvoted 1 times
arcsw
12 months ago
no, C is incorrect, youre only excluding a value not the field name
upvoted 1 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago