SPLK-1001 Using Fields and Lookups Practice Question
A security analyst is investigating a breach and needs to extract the 'user_id' field from raw log events. The logs contain both structured and unstructured data. The analyst uses the following search: `index=security sourcetype=syslog | rex field=_raw "user_id=(?<user_id>\w+)" | stats count by user_id`. However, some events do not contain the 'user_id' pattern, but they have a 'username' field extracted by a default extraction. The analyst wants to create a unified field 'user_id' that includes values from both. Which approach should the analyst take?
⚠ Common exam trap
Splunk often tests the distinction between `coalesce` and `fillnull` or `rename`, where candidates mistakenly choose `fillnull` thinking it fills missing values, but it only replaces nulls with a static value rather than merging from another field.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use `eval user_id=coalesce(user_id, username)` to take the first non-null value
The `coalesce` function returns the first non-null value from a list of fields, making it ideal for merging `user_id` and `username` into a single unified field. Since `user_id` may be null in events where the regex extraction fails, `coalesce(user_id, username)` will use the `username` value as a fallback, ensuring all events contribute to the `stats count` without data loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rename the 'username' field to 'user_id' using `rename username as user_id`
Why it's wrong here
Renaming only renames an existing field; it does not populate user_id from the regex extraction.
- ✗
Use `eval user_id=mvindex(split(user_id+" "+username," "),0)` to combine the two fields
Why it's wrong here
The `mvindex(split(...))` approach concatenates `user_id` and `username` with a space, then splits back and takes the first element. This fails because events lacking the `user_id` pattern leave `user_id` as an empty string, so the split produces `" username"`, and `mvindex(...,0)` returns an empty string, not the `username` value. It is tempting because `mvindex` and `split` are commonly used to deduplicate or select the first non-null value from a list, which would work if both fields were always populated.
- ✗
Use `fillnull value=N/A user_id` to handle missing values
Why it's wrong here
`fillnull` only replaces null values; it does not populate user_id from username.
- ✓
Use `eval user_id=coalesce(user_id, username)` to take the first non-null value
Why this is correct
`coalesce` returns the first non-null value among the fields, effectively unifying the field.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1001 question from scratch — 502 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.