In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")
In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")
In the given eval statement using the case function, the description field is assigned a value based on the condition of the status field. The conditions specified are for status codes 200, 404, and 500. Since the status is 503, none of the conditions are met. According to the documentation of the case function in Splunk, if no conditions are true, the function defaults to NULL. Therefore, the description field would contain no value.
A. The description field would contain no value.
It's A as you can see in the example here: https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/ConditionalFunctions
answer is A, tested it on splunk version 7.2.7
The description field would contain no value.
The right answer is A, checked in lab.
https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/ConditionalFunctions "The function defaults to NULL if none are true."
D is correct
could you pls confirm the final answer friends? A or D?
B -> pg 119 "if no value, default replacement value is 0"
Only with fillnull command. So it is A.
The answer is "A". Please correct it.
Try it yourself
correct ans is A
correct answer C Reference link https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/ConditionalFunctions
bruh...
| makeresults | eval status=503 | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")