SPLK-1002 · Question #53
Which of the following commands will show the maximum bytes?
The correct answer is C. sourcetype=access_* | stats max(bytes). The stats command with the max() aggregate function is the correct Splunk SPL syntax for returning the maximum value of a numeric field like bytes.
Question
Which of the following commands will show the maximum bytes?
Options
- Asourcetype=access_* | maximum totals by bytes
- Bsourcetype=access_* | avg (bytes)
- Csourcetype=access_* | stats max(bytes)
- Dsourcetype=access_* | max(bytes)
How the community answered
(39 responses)- A8% (3)
- B3% (1)
- C87% (34)
- D3% (1)
Why each option
The stats command with the max() aggregate function is the correct Splunk SPL syntax for returning the maximum value of a numeric field like bytes.
'maximum totals by bytes' is not valid Splunk SPL; there is no 'maximum' command or function in the Splunk search language.
'| avg(bytes)' would compute the average of the bytes field rather than the maximum, returning the wrong metric entirely.
The syntax '| stats max(bytes)' correctly invokes the stats command with the max() aggregate function, which scans all matching events and returns the single highest bytes value found. Aggregate functions in Splunk must be called as arguments inside stats, making this the only valid option.
'| max(bytes)' is invalid SPL because aggregate functions like max() cannot be used as standalone pipe commands; they require the stats command as a wrapper.
Concept tested: Splunk stats max function syntax for field maximum
Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats
Topics
Community Discussion
No community discussion yet for this question.