A Splunk admin has a field `src_ip` that contains IP addresses, and wants to create a new field `src_octet1` that contains the first octet of the IP address. Which approach should the admin use?

Use the `eval` command to create a calculated field, e.g., `... | eval src_octet1 = split(src_ip, ".")[0]`

Use the `table` command to create `src_octet1`

Use the `fields` command to add `src_octet1`

Use the `rename` command to rename `src_ip` to `src_octet1`

SplunkCore Certified User

Domain 3Objective 2

Use Fields in Searches SPLK-1001 Practice Questions (Page 3)

Part of the Using Fields in Searches domain, which accounts for 20% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~5–8 in this domain), expect 2–3 from this objective — we provide 11 practice questions to prepare you well beyond it. (estimate)

11questions here

3free pages

6concepts

20%of the exam

Questions 11–11

11application · medium
A Splunk admin has a field `src_ip` that contains IP addresses, and wants to create a new field `src_octet1` that contains the first octet of the IP address. Which approach should the admin use?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.

Use Fields in Searches SPLK-1001 Practice Questions (Page 3)

Questions 11–11

A Splunk admin has a field `src_ip` that contains IP addresses, and wants to create a new field `src_octet1` that contains the first octet of the IP address. Which approach should the admin use?

Keep studying — Using Fields in Searches