What is correct syntax for split function in Splunk eval?

Which of the following is valid syntax for the split function?

  1. | eval split phoneNumber by “-“ as areaCode
  2. | eval areaCodes - split(phoneNumber, “-“) Source Reference Answer
  3. | eval phoneNumber split(“-“, 3, areaCodes)
  4. | eval split(phoneNumber, “-“, areaCodes)

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests your ability to recall the exact eval function syntax, and the common trap is confusing assignment (=) with a hyphen or mixing argument order.

The correct answer is B, though it must use an equals sign: | eval areaCodes = split(phoneNumber, "-"). Community consensus confirms that the split function takes a field and delimiter and returns multiple values.

The most common mistake is choosing option B without noticing that it originally says `areaCodes - split(...)` instead of `areaCodes = split(...)`. This makes the expression invalid because `eval` requires a field assignment using `=`.

Community Discussion (4 comments)

teeec 👍 1 Selected: B
| eval areaCodes = split(phoneNumber, "-")
c1c8784 👍 1 Selected: B
B. Is the only correct answer, but needs the '-' in "areaCodes - split(phoneNumber, "-")" to be changed to "areaCodes = split(phoneNumber, "-")" As a50b9c8 suggests.
a50b9c8 👍 1 Selected: B
The answer is B but replace - to = to become ( |evan area=split( x , delim)
Derag 👍 2
No, the correct answer is B. This syntax splits the phoneNumber field using the "-" delimiter and creates a new field areaCodes with the split values.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

B is the only option that resembles the proper eval expression form. In Splunk, the split function is used as split(field, delimiter) and returns a multivalue. Commenters note that B is correct only if the hyphen is replaced with =, as in | eval areaCodes = split(phoneNumber, "-").

Why the Other Options Are Wrong

A is invalid because eval does not support split phoneNumber by "-" as a bare function call. C puts the arguments in the wrong order and also does not assign to a field correctly. D uses a function call on the left side of a comma and lacks the field assignment syntax that eval requires.

Community Comment Notes

Commenters unanimously agree on B and highlight the typo in the printed option, noting that the hyphen should be an equals sign. One commenter suggests correcting it to | eval areaCodes = split(phoneNumber, "-") before selecting B, while another describes the same fix.

Official Reference

Exam Strategy

In the exam, check every character in eval expressions — a common trap is a hyphen instead of an equals sign. Remember the exact syntax: | eval new_field = split(existing_field, delimiter).

Related Analysis

Which function of the stats command creates a multivalue ent

A-Grade

Which statement about the coalesce function is accurate?

A-Grade

Assuming a standard time zone across the environment, what s

S-Grade

Practice All SPLK-1004 Questions

Access 130 questions with complete answers and detailed explanations.

View Full SPLK-1004 Practice Test →

← Back to SPLK-1004 Study Guide