SPLK-1002 · Question #118
Which of the following commands support the same set of functions?
The correct answer is C. stats, chart, timechart. The stats, chart, and timechart commands all share the same set of statistical functions such as count, sum, avg, min, and max. The other groupings mix commands with incompatible or distinct function sets.
Question
Which of the following commands support the same set of functions?
Options
- Astats, eval, table
- Bsearch, where, eval
- Cstats, chart, timechart
- Dtransaction, chart, timechart
How the community answered
(15 responses)- A7% (1)
- C93% (14)
Why each option
The stats, chart, and timechart commands all share the same set of statistical functions such as count, sum, avg, min, and max. The other groupings mix commands with incompatible or distinct function sets.
The table command does not accept statistical functions at all; it only rearranges and displays existing fields.
The search and where commands use Boolean and comparison expressions, not statistical aggregation functions.
The stats, chart, and timechart commands all accept the same common statistical functions (count, sum, avg, min, max, dc, etc.) because chart and timechart are essentially graphical extensions of stats. This shared function set is documented as the 'common stats functions' in Splunk's reference.
The transaction command groups events into transactions using different arguments and does not share the same statistical function set as chart and timechart.
Concept tested: shared statistical functions across stats, chart, timechart
Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions
Topics
Community Discussion
No community discussion yet for this question.