An analyst has a field `path` that contains a file path like `/var/log/app/error.log`. The analyst wants to create a multivalued field containing each directory component separately (e.g., `var`, `log`, `app`). Which search correctly creates this multivalued field?

`... | eval path_parts=split(path, "/")`

`... | makemv delim="/" path | eval path_parts=mvfilter(path != "")`

`... | eval path_parts=mvindex(path, 1)`

A Splunk analyst has a multivalued field `tags` containing tags like `prod`, `web`, `critical`. The analyst needs to find events where the tag `critical` appears, but only if the event also has the tag `prod`. Which search correctly identifies these events?

`... | search tags = "critical prod"`

`... | eval has_critical=mvfilter(match(tags, "critical")), has_prod=mvfilter(match(tags, "prod")) | where mvcount(has_critical) > 0 AND mvcount(has_prod) > 0`

`... | where tags == "critical" AND tags == "prod"`

`... | search tags = "critical" AND tags = "prod"`

Which of the following best describes how a multivalued field stores data in Splunk?

As a single value that can be split into multiple values only at search time.

As a list of values, where each value is an element that can be accessed by its position.

As a single string with a fixed delimiter that cannot be changed.

What is the purpose of the mvexpand command in Splunk?

To split a single string field into multiple values.

To remove empty values from a multivalued field.

To combine multiple events into a single event with a multivalued field.

To expand a multivalued field into multiple events, one per value.

A SOC analyst has a multivalued field `user_agents` containing multiple user-agent strings per event. The analyst wants to filter out any user-agent that contains the string 'bot' and keep only the remaining values. Which eval function accomplishes this?

`mvfilter(user_agents != "*bot*")`

`mvfilter(match(user_agents, "bot"))`

`mvfilter(NOT match(user_agents, "bot"))`

`mvfilter(user_agents NOT LIKE "%bot%")`

SplunkCore Certified Advanced Power User

Domain 2Objective 5

Multivalued Fields core-certified-advanced-power-user Practice Questions (Page 4)

Part of the Fields, Lookups, and Data domain, which makes up ~17% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

6concepts

Questions 16–20

16application · medium
An analyst has a field `path` that contains a file path like `/var/log/app/error.log`. The analyst wants to create a multivalued field containing each directory component separately (e.g., `var`, `log`, `app`). Which search correctly creates this multivalued field?
Select an answer first
17expert · medium
A Splunk analyst has a multivalued field `tags` containing tags like `prod`, `web`, `critical`. The analyst needs to find events where the tag `critical` appears, but only if the event also has the tag `prod`. Which search correctly identifies these events?
Select an answer first
18foundation · easy
Which of the following best describes how a multivalued field stores data in Splunk?
Select an answer first
19foundation · easy
What is the purpose of the mvexpand command in Splunk?
Select an answer first
20application · medium
A SOC analyst has a multivalued field `user_agents` containing multiple user-agent strings per event. The analyst wants to filter out any user-agent that contains the string 'bot' and keep only the remaining values. Which eval function accomplishes this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to core-certified-advanced-power-user

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “core-certified-advanced-power-user” is a trademark of its owner, used for identification only.