Basic Searching and Transforming Commands →hardMultiple ChoiceObjective-mapped

SPLK-1001 Basic Searching and Transforming Commands Practice Question

Exhibit

index=app sourcetype=json_logs
 | spath input=raw_data path=response.status
 | search response.status=200
 | stats count by response.status

Refer to the exhibit. The search returns zero results. What is a likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The 'raw_data' field may not contain valid JSON

The 'spath' command extracts fields from JSON, but if 'raw_data' is not a valid JSON string, extraction fails. Also, 'search' after 'spath' should work, but if 'response.status' is not extracted, no results. The most common issue is that the field 'raw_data' might not exist or the JSON path is incorrect.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The 'spath' command should use 'output=response.status' to create the field
Why it's wrong here
spath already extracts the field.
✓
The 'raw_data' field may not contain valid JSON
Why this is correct
If raw_data is not JSON, spath produces no fields.
✗
The search should be 'sourcetype=json_logs' first
Why it's wrong here
The order is fine.
✗
The 'stats' command cannot use 'response.status' because it's not a field
Why it's wrong here
It is a field if extracted correctly.

Go deeper

SPLK-1001 Basic Searching and Transforming Commands Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question