A user wants a table that will show the total revenue made for each product in each sales region. Which would be the correct SPL query to use?

The correct answer is B. index=X | chart sum(price) by product, region. The chart command with sum(price) by product, region will return a table where the total revenue (price) is aggregated (sum) for each product and sales region. This is the correct way to aggregate data in Splunk.

Using Transforming Commands for Visualizations

Question

Options

Aindex=X sourcetype=Y | chart sum(product) by price AND region
Bindex=X | chart sum(price) by product, region
Cindex=X | chart total(product) over price by region
Dindex=X | chart total(price) by product, region

How the community answered

(33 responses)

A
6% (2)
B
91% (30)
C
3% (1)

Explanation

The chart command with sum(price) by product, region will return a table where the total revenue (price) is aggregated (sum) for each product and sales region. This is the correct way to aggregate data in Splunk.

Topics

#chart command#aggregation#grouping data#SPL syntax

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice