SPLK-1002 · Question #100
Which of the following searches would return a report of sales by product-name?
The correct answer is B. chart sum(price) as sales by product_name. To generate a named sales report by product, you must use an aggregation function like sum() aliased with 'as', paired with a 'by' clause grouping by the target field.
Question
Which of the following searches would return a report of sales by product-name?
Options
- Achart sales by product_name
- Bchart sum(price) as sales by product_name
- Cstats sum(price) as sales over product_name
- Dtimechart list(sales), values(product_name)
How the community answered
(14 responses)- B93% (13)
- C7% (1)
Why each option
To generate a named sales report by product, you must use an aggregation function like sum() aliased with 'as', paired with a 'by' clause grouping by the target field.
'sales' is not a Splunk aggregation function; referencing it directly without sum() or another function will not compute a meaningful aggregate.
'chart sum(price) as sales by product_name' correctly aggregates the price field using a statistical function, aliases the result as 'sales', and groups the output by product_name - producing a report of sales per product.
The stats command uses 'by' not 'over' for grouping; 'stats sum(price) as sales over product_name' uses invalid syntax.
timechart is designed for time-based visualizations and requires a _time field on the x-axis, making it unsuitable for a product-name report.
Concept tested: Splunk chart aggregation with alias and grouping
Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Chart
Topics
Community Discussion
No community discussion yet for this question.