SPLK-CVAL - Comparing Values

Topic 1 – Using eval to Compare

• Understand the eval command
• Explain evaluation functions
• Identify and use comparison and conditional functions
• Use the fieldformat command to format field values

Topic 2 – Filtering with where

• Use the where command to filter results
• Use wildcards with the where command
• Filter fields with the information functions, isnull and isnotnull

Topic 3 – Using Fields in Searches

• Use fields correctly in basic searches
• Use fields with operators
• Use the rename command
• Use the fields command to improve search performance

Topic 4 – Comparing Temporary versus Persistent Fields

• Differentiate between temporary and persistent fields
• Create temporary fields with the eval command
• Extract temporary fields with the erex and rex commands

Topic 5 – Enriching Data

• Understand how fields from lookups, calculated fields, field aliases, and field extractions enrich data