Which of the following actions can the eval command perform?
Which of the following actions can the eval command perform?
The eval command is used to calculate an expression and store the result in a new or existing field in search results. It cannot remove fields from results, group transactions by any fields, or save SPL commands for reuse. Therefore, the eval command can create or replace an existing field.
B is correct
Is "A" true?
"A" should be incorrect, "eval" can create or replace fields, but not remove.
It's B
B is right
The Correct is b
just B, confirmed
i cinfirm it's B
The Correct is b. The eval command calculates an expression and puts the resulting value into a search results field.
B is true
"B" is also true.
Is "A" True also?
Answer B. Slide 97 Results of eval written to either new or existing field you specify. If the destination field exists, the value of the field are replaced by the result of eval
B is correct. Reference: https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Eval
Its should be B
B correct
Best without wildcards