Splunk Core Certified User Practice Exam

Which command would NOT be used to filter results based on specific fields?

1. | where VendorCity = 'New York'

2. | search VendorCity='New York'

3. | eval VendorCity='New York'

4. | table VendorCity

The correct answer is: | eval VendorCity='New York'

The command that would not be used to filter results based on specific fields is the one that utilizes the eval function to assign a value. The eval command is primarily used for calculations and transformations, allowing you to create new fields or modify existing ones. In this case, it is being used to set the value of the VendorCity field to 'New York' rather than filtering the results to only those where the VendorCity is 'New York'. In contrast, the other commands directly filter the results based on the specified condition. The where and search commands both allow you to specify criteria for filtering events in the dataset, keeping only those records that match the condition set (VendorCity = 'New York'). Meanwhile, the table command organizes the output by displaying the specified field, but it does not perform any filtering as the other commands do. Thus, the command that involves eval is not a filtering command and, therefore, is not appropriate for that purpose.