A user runs the following search: index--X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother--f Which of the following table headers match the…

The correct answer is C. Product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum. When using the chart command with multiple statistical functions and a by clause containing two fields, the first by field (product) becomes the row identifier (leftmost column), and the second field (action) values become column headers prefixed by each function name. The…

Using Transforming Commands for Visualizations

Question

A user runs the following search:

index--X sourcetype=Y I chart count (domain) as count, sum (price) as sum by product, action usenull=f useother--f Which of the following table headers match the order this command creates?

Options

AThe chart command does not allow for multiple statistical functions.
BProduct, sum: addtocart, sum: remove, sum: purchase, count: addtocart, count: remove, count:
CProduct, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum:
DCount: product, sum: product, count: action, sum: action

How the community answered

(41 responses)

A
5% (2)
B
7% (3)
C
71% (29)
D
17% (7)

Explanation

When using the chart command with multiple statistical functions and a by clause containing two fields, the first by field (product) becomes the row identifier (leftmost column), and the second field (action) values become column headers prefixed by each function name. The functions are listed in the order they appear in the command - count first, then sum. So column headers follow the pattern: product, count: addtocart, count: remove, count: purchase, sum: addtocart, sum: remove, sum: purchase. This matches option C.

Topics

#chart command#statistical functions#output formatting#grouping results

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice