nerdexam
Splunk

SPLK-1002 · Question #53

Which of the following commands will show the maximum bytes?

The correct answer is C. sourcetype=access_* | stats max(bytes). The stats command with the max() aggregate function is the correct Splunk SPL syntax for returning the maximum value of a numeric field like bytes.

Basic Transforming Commands

Question

Which of the following commands will show the maximum bytes?

Options

  • Asourcetype=access_* | maximum totals by bytes
  • Bsourcetype=access_* | avg (bytes)
  • Csourcetype=access_* | stats max(bytes)
  • Dsourcetype=access_* | max(bytes)

How the community answered

(39 responses)
  • A
    8% (3)
  • B
    3% (1)
  • C
    87% (34)
  • D
    3% (1)

Why each option

The stats command with the max() aggregate function is the correct Splunk SPL syntax for returning the maximum value of a numeric field like bytes.

Asourcetype=access_* | maximum totals by bytes

'maximum totals by bytes' is not valid Splunk SPL; there is no 'maximum' command or function in the Splunk search language.

Bsourcetype=access_* | avg (bytes)

'| avg(bytes)' would compute the average of the bytes field rather than the maximum, returning the wrong metric entirely.

Csourcetype=access_* | stats max(bytes)Correct

The syntax '| stats max(bytes)' correctly invokes the stats command with the max() aggregate function, which scans all matching events and returns the single highest bytes value found. Aggregate functions in Splunk must be called as arguments inside stats, making this the only valid option.

Dsourcetype=access_* | max(bytes)

'| max(bytes)' is invalid SPL because aggregate functions like max() cannot be used as standalone pipe commands; they require the stats command as a wrapper.

Concept tested: Splunk stats max function syntax for field maximum

Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats

Topics

#Splunk Search Language#stats command#aggregation functions#max function

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice