SPLK-1001 Using Fields and Lookups Practice Question
A search returns many events but the 'status' field is missing from some events. The admin wants to set a default value of 'unknown' when the field is absent. Which command should be used?
⚠ Common exam trap
Many exam-takers confuse `fillnull` with `eval coalesce`, but `coalesce` only handles null values within existing fields and cannot create a field that is completely absent from an event, whereas `fillnull` explicitly addresses missing fields.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
fillnull value=unknown status
The `fillnull` command explicitly sets a default value for specified fields when they are null or missing in search results. In this scenario, `fillnull value=unknown status` replaces all null or absent 'status' field values with 'unknown', ensuring consistency across events. This command is designed specifically for handling missing field values in Splunk, unlike `eval` or `default` which operate differently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
eval status=coalesce(status, "unknown")
Why it's wrong here
The coalesce function requires the field to exist in the event, even if its value is null. If the status field is entirely absent from an event, eval cannot reference it to perform the comparison. This approach works when a field exists but contains a null value, whereas fillnull handles cases where the field name itself does not appear in the event data.
- ✗
default status=unknown
Why it's wrong here
There is no default command in Splunk.
- ✓
fillnull value=unknown status
Why this is correct
fillnull sets null fields to a specified value.
- ✗
replace status with "unknown"
Why it's wrong here
replace is for substituting values, not null handling.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.