What is correct syntax for split function in Splunk eval?
Short answer
B | eval areaCodes - split(phoneNumber, “-“)
Question
Key Takeaways
The question tests your ability to recall the exact
evalfunction syntax, and the common trap is confusing assignment (=) with a hyphen or mixing argument order.
The correct answer is B, though it must use an equals sign: | eval areaCodes = split(phoneNumber, "-"). Community consensus confirms that the split function takes a field and delimiter and returns multiple values.
Common mistake: The most common mistake is choosing option B without noticing that it originally says `areaCodes - split(...)` instead of `areaCodes = split(...)`. This makes the expression invalid because `eval` requires a field assignment using `=`.
Expert Analysis
Why the Answer Is Correct
B is the only option that resembles the proper eval expression form. In Splunk, the split function is used as split(field, delimiter) and returns a multivalue. Commenters note that B is correct only if the hyphen is replaced with =, as in | eval areaCodes = split(phoneNumber, "-").
Why the Other Options Are Wrong
A is invalid because eval does not support split phoneNumber by "-" as a bare function call. C puts the arguments in the wrong order and also does not assign to a field correctly. D uses a function call on the left side of a comma and lacks the field assignment syntax that eval requires.
Community Comment Notes
Commenters unanimously agree on B and highlight the typo in the printed option, noting that the hyphen should be an equals sign. One commenter suggests correcting it to | eval areaCodes = split(phoneNumber, "-") before selecting B, while another describes the same fix.
Official Reference
- https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
- https://docs.splunk.com/Documentation/SCS/current/SearchReference/Eval
These links open the official vendor documentation in a new tab.
Exam Strategy
In the exam, check every character in eval expressions — a common trap is a hyphen instead of an equals sign. Remember the exact syntax: | eval new_field = split(existing_field, delimiter).
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
Derag 👍 2No, the correct answer is B. This syntax splits the phoneNumber field using the "-" delimiter and creates a new field areaCodes with the split values.
-
c1c8784 👍 1 Answered BB. Is the only correct answer, but needs the '-' in "areaCodes - split(phoneNumber, "-")" to be changed to "areaCodes = split(phoneNumber, "-")" As a50b9c8 suggests.
-
a50b9c8 👍 1 Answered BThe answer is B but replace - to = to become ( |evan area=split( x , delim)
-
teeec 👍 1 Answered B| eval areaCodes = split(phoneNumber, "-")
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SPLK-1004 Questions
Access 130 questions with complete answers and detailed explanations.
View Full SPLK-1004 Practice Test →