SPLK-1001 Using Fields and Lookups Practice Question
A search uses `| fields - _raw, _time` and then later needs `_time` again. What will happen?
⚠ Common exam trap
Candidates often assume internal fields like `_time` cannot be removed or that removing them only empties the value, when in fact the `fields` command with a minus sign completely deletes the field from the event data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The `_time` field is no longer available for later commands.
The `| fields - _raw, _time` command explicitly removes the `_time` field from the search results. Once a field is removed using the `fields` command with a minus sign, it is no longer available for any subsequent commands in the search pipeline. This is because the `fields` command operates on the current working set of events, stripping out the specified fields entirely, and later commands cannot reference a field that has been removed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The `_time` field is no longer available for later commands.
Why this is correct
The fields command with '-' removes those fields from subsequent processing.
- ✗
The command removes all fields except _raw and _time.
Why it's wrong here
The '-' prefix removes the listed fields.
- ✗
The command will cause an error because you cannot remove internal fields.
Why it's wrong here
You can remove internal fields like _raw and _time.
- ✗
The `_time` field will still be available but empty.
Why it's wrong here
Removed fields are not available.
Go deeper
Related to this question
About these practice questions
This SPLK-1001 question is part of Courseiva's 502-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.