dc dotCreds
Interview Prep

Splunk Core Certified User Interview Questions

Practice real interview prompts based on Splunk Core Certified User objectives. Review strong sample answers, listening cues, and common traps before the conversation gets real.

Back to Dashboard Open Pro Hub
Question 1 of 14

You are filtering network events and need to exclude `src_ip=10.0.0.5`, but you also want to exclude events where `src_ip` is missing. What SPL comparison would you use, and how would its behavior differ from `NOT src_ip="10.0.0.5"`?

Strong Interview Answer

Use `src_ip!="10.0.0.5"`. The `!=` comparison requires `src_ip` to exist and have a different value. `NOT src_ip="10.0.0.5"` also matches events where `src_ip` is undefined, so it is broader when missing fields are present.

What to Listen For

  • `!=` requires the field to exist
  • `NOT field=value` can include missing-field events
  • precise field-value exclusion
  • awareness that the two forms are not equivalent

Caution

A strong answer must explain the missing-field difference, not merely repeat the operator.