A Splunk admin is building a search that processes events from multiple sources. The 'status_code' field is sometimes a string like '200' and sometimes a number. The admin needs to create a field 'status_category' with values 'OK' for 2xx, 'Error' for 4xx/5xx, and 'Unknown' for anything else, including null. The admin also needs to ensure that the search does not fail when status_code is null. Which search correctly handles all these cases?

... | eval status_category = if(status_code >= 200 AND status_code = 400 AND status_code < 600, "Error", "Unknown"))

... | eval status_category = case(status_code >= 200 AND status_code = 400 AND status_code < 600, "Error", 1=1, "Unknown")

... | eval status_category = coalesce(case(status_code >= 200 AND status_code = 400 AND status_code < 600, "Error"), "Unknown")

... | eval status_num = tonumber(status_code) | eval status_category = case(status_num >= 200 AND status_num = 400 AND status_num < 600, "Error", 1=1, "Unknown")

SplunkCore Certified Advanced Power User

Domain 1Objective 2

String and Conditional Functions core-certified-advanced-power-user Practice Questions (Page 3)

Part of the Advanced Search Commands domain, which makes up ~19% of our current practice bank. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)

16questions here

4free pages

5concepts

Questions 11–15

11foundation · easy
Which informational function returns the number of characters in a string value?
Select an answer first
12foundation · easy
Which comparison function evaluates multiple conditions in order and returns the value associated with the first condition that is true?
Select an answer first
13expert · hard
A Splunk admin is building a search that processes events from multiple sources. The 'status_code' field is sometimes a string like '200' and sometimes a number. The admin needs to create a field 'status_category' with values 'OK' for 2xx, 'Error' for 4xx/5xx, and 'Unknown' for anything else, including null. The admin also needs to ensure that the search does not fail when status_code is null. Which search correctly handles all these cases?
Select an answer first
14foundation · easy
Which conditional function returns a null value if two specified values are equal?
Select an answer first
15foundation · easy
Which informational function returns the data type of a field value?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to core-certified-advanced-power-user

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “core-certified-advanced-power-user” is a trademark of its owner, used for identification only.

String and Conditional Functions core-certified-advanced-power-user Practice Questions (Page 3)

Questions 11–15

Which informational function returns the number of characters in a string value?

Which comparison function evaluates multiple conditions in order and returns the value associated with the first condition that is true?

Which conditional function returns a null value if two specified values are equal?

Which informational function returns the data type of a field value?

Keep studying — Advanced Search Commands