Which of the following Is valid syntax for the split function?

Which of the following Is valid syntax for the split function?
A . …| eval split phoneNUmber by "_" as areaCodes.
B . …| eval areaCodes = split (phonNumber, "_"
C . …| eval phoneNumber split("-", 3, areaCodes)
D . …| eval split (phone-Number, "_", areaCodes)

View Answer

Answer: B

Explanation:

The valid syntax for using the split function in Splunk is … | eval areaCodes = split(phoneNumber, "_") (Option B). The split function divides a string into an array of substrings based on a specified delimiter, in this case, an underscore. The resulting array is stored in the new field areaCodes.