ExamTopics Logo
Mail Us[email protected]
Menu
Splunk Discussions
exam questions

Exam SPLK-1002 All Questions

View all questions & answers for the SPLK-1002 exam
Go to Exam

Exam SPLK-1002 topic 1 question 39 discussion

Actual exam question from Splunk's SPLK-1002
Question #: 39
Topic #: 1
[All SPLK-1002 Questions]

What other syntax will produce exactly the same results as | chart count over vendor_action by user?

  • A. | chart count by vendor_action, user
  • B. | chart count over vendor_action, user
  • C. | chart count by vendor_action over user
  • D. | chart count over user by vendor_action
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
by oksey at Aug. 31, 2020, 3 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
kbisht
Highly Voted 3 years, 4 months ago
A is the correct ans
upvoted 20 times
...
sid2051
Highly Voted 3 years, 4 months ago
A is the correct answer it will produce exactly the same chart
upvoted 13 times
...
Bibs_s
Most Recent 4 months, 3 weeks ago
Selected Answer: A
A is correct
upvoted 1 times
...
Harrysa
9 months ago
A is correct, "over" is used for time-based aggregation, while "by" is used for field-based aggregation.
upvoted 2 times
...
emlch
1 year, 6 months ago
Equivalent expressions: by <field>, <field2> over <field> by <field2>
upvoted 4 times
...
nupacniyiveli
2 years ago
A is correct
upvoted 1 times
...
BengieQuesada
2 years, 5 months ago
A is correct, reference F2 page 52
upvoted 4 times
...
Lalithadevi
2 years, 9 months ago
A is correct
upvoted 1 times
...
robotn1k
2 years, 11 months ago
A is the correct answer Chart syntax is: over = [row-split] by = [column-split] By default, the first field name after the chart command is the [row-split] and the second is [column-split], so B would be the same as the example in the question https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Chart
upvoted 3 times
...
allansid
3 years, 2 months ago
answer A
upvoted 7 times
...
oksey
3 years, 4 months ago
I think B is correct
upvoted 1 times
Sartarus
3 years, 4 months ago
B it's not possible
upvoted 1 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel