SPLK-1002 Advanced Searching and Statistics Practice Question
Which THREE of the following are valid ways to extract a substring from a field named "full_name" that contains "Firstname Lastname" into separate fields?
⚠ Common exam trap
Splunk often tests the distinction between commands that extract fields (like `rex` and `eval` with `split`) versus commands that only filter or transform data without creating new fields (like `regex` and `extract` with incorrect syntax).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
eval first=split(full_name," ")[0], last=split(full_name," ")[1]
The `split` function in Splunk's `eval` command returns a multivalue field from a string based on a delimiter, and array indexing with `[0]` and `[1]` extracts the first and second elements respectively. This directly splits "Firstname Lastname" into two separate fields named `first` and `last`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
extract field=full_name first=1 last=2
Why it's wrong here
The 'extract' command is for key-value pairs, not substring extraction.
- ✓
eval first=split(full_name," ")[0], last=split(full_name," ")[1]
Why this is correct
Splits the field into an array and indexes elements.
- ✓
rex field=full_name "^(?<first>\w+)\s+(?<last>\w+)$"
Why this is correct
Extracts first and last using regular expression groups.
- ✓
makemv delim=" " full_name | eval first=mvindex(full_name,0), last=mvindex(full_name,1)
Why this is correct
Converts the field into a multivalued field and accesses elements by index.
- ✗
regex field=full_name "(?<first>[^ ]+) (?<last>[^ ]+)"
Why it's wrong here
The 'regex' command filters events, does not extract fields.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.