Which eval operator concatenates a string and a number in Splunk?

SPLK-1002 By islever Editorial Last updated

Short answer

D . (period)

Question

When using the eval command, which of these characters can be used to concatenate a string and a number into a single value?
  1. ~ (tilde)
  2. & (ampersand)
  3. + (plus)
  4. . (period) Correct Answer

Key Takeaways

The exam tests the specific eval operator behavior: the period (.) concatenates strings and numbers, while the plus (+) cannot mix types for concatenation.

In Splunk's eval command, the period (.) operator concatenates a string and a number into a single value. Community votes favor D, but some misidentify the plus (+) operator, which actually only concatenates two strings or adds two numbers.

Common mistake: Choosing C. Plus (+) is a common mistake because many programming languages use + for concatenation, but Splunk's eval plus only concatenates two strings or adds two numbers; it does not accept a string and number mix.

Expert Analysis

Why the Answer Is Correct

The correct answer is D. Splunk's eval command uses the period (.) operator specifically for concatenating a string and a number. This is documented in the official eval operators table. As one commenter notes, "The period ( . ) operator concatenates both strings and numbers. Numbers are concatenated in their string represented form." This means the result is always a string.

Why the Other Options Are Wrong

A (~) is not a valid eval operator for concatenation. B (&) is also not used for concatenation in Splunk. C (+) is a common trap: it concatenates two strings or adds two numbers, but it cannot mix a string and a number. One commenter incorrectly claimed C is correct, but they overlooked the distinction between string-string concatenation and string-number concatenation.

Community Comment Notes

Several commenters correctly identified D with supporting explanations. Comment 1 states that the period concatenates both strings and numbers, while the plus concatenates string with string or number with number. Comment 3 provides a direct link to the official Splunk documentation. Comment 5, which argues for C, is misleading and reflects a misunderstanding of eval operator rules in Splunk.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Memorize Splunk's eval operator table: '+' is for addition or string-string concatenation, while '.' is for string-number concatenation. On the exam, read the prompt carefully to see whether they ask for 'string and number' (use '.') or 'string and string' (use '+').

Community Votes

D
60%
C
40%

60% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. NastyNutsu 👍 4
    D - (.) concatenated both strings and numbers. where (plus) concatenate the string with string or number with number.
  2. 8b5c1e8 👍 3
    D - Operators that produce numbers The plus ( + ) operator accepts two numbers for addition, or two strings for concatenation. The subtraction ( - ), multiplication ( * ), division ( / ), and modulus ( % ) operators accept two numbers. Operators that produce strings The period ( . ) operator concatenates both strings and number. Numbers are concatenated in their string represented form.
  3. tonydbass 👍 2 Answered D
    https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/Eval#:~:text=of%20functions.-,Operators,-The%20following%20table
  4. alexoancea08 👍 1 Answered C
    A. ~ (tilde) → Not used for concatenation in Splunk. B. & (ampersand) → Not a valid operator for concatenation. D. . (period) → Not used for string concatenation in Splunk (unlike some other languages like PHP). so C is the ans
  5. FrozenYeti 👍 1 Answered C
    Answer is C The concatenation operator accepts both strings and numbers. Numbers are concatenated as strings and produces a string.
Show 1 more comment
  1. jbr21 👍 1 Answered D
    Answer is D for number and string

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Filter Events by Tag and Field in Splunk

S-grade

Which Field Extractor method extracts a port number from an event?

S-grade

How to Pass Arguments to a Nested Macro in Splunk?

S-grade

What Happens When You Edit Regex in Splunk Field Extractor?

S-grade

Practice All SPLK-1002 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SPLK-1002 Practice Test →

← Back to SPLK-1002 Study Guide