Posted by: Pdfprep
Post Date: March 31, 2021
Where are the results of eval commands stored?
A . In a field.
B . In an index.
C . In a KV Store.
D . In a database.
Answer: A
Explanation:
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Eval
The eval command calculates an expression and puts the resulting value into a search results field.
✑ If the field name that you specify does not match a field in the output, a new field is added to the search results.
✑ If the field name that you specify matches a field name that already exists in the search results, the results of the eval expression overwrite the values in that field.
Leave a Reply