When using the top command in the following search, which of the following will be true about the results? index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f…

The correct answer is B. The top three most common values in statusCode will be displayed for each user. The top command returns the most common values of a field and their count. By using the by clause, you can group the results by another field. In this case, the top command will return the top three most common values in statusCode for each user. The showperc=f option will…

Monitoring, logging, and remediation

Question

When using the top command in the following search, which of the following will be true about the results? index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f countfield=status_code_count

Options

AThe search will fail. The proper top command format is top limit=3 instead of top .
BThe top three most common values in statusCode will be displayed for each user.
COnly the top three overall most common values in statusCode will be displayed.
DThe percentage field will be displayed in the results.

How the community answered

(41 responses)

A
7% (3)
B
80% (33)
C
2% (1)
D
10% (4)

Explanation

The top command returns the most common values of a field and their count. By using the by clause, you can group the results by another field. In this case, the top command will return the top three most common values in statusCode for each user. The showperc=f option will suppress the percentage column in the output. The countfield option will rename the count column to status_code_count.

Topics

#Splunk#top command#by clause#SPL options

Community Discussion

No community discussion yet for this question.

Full SPLK-1001 Practice