SPLK-1002 · Question #54
Which of the following searches will show the number of categoryld used by each host?
The correct answer is B. Sourcetype=access_* |stats sum(categorylD. by host. The stats command with sum() and the 'by' clause is the correct Splunk SPL syntax for aggregating a numeric field grouped by another field such as host.
Question
Which of the following searches will show the number of categoryld used by each host?
Options
- ASourcetype=access_* |sum bytes by host
- BSourcetype=access_* |stats sum(categorylD. by host
- CSourcetype=access_* |sum(bytes) by host
- DSourcetype=access_* |stats sum by host
How the community answered
(24 responses)- A4% (1)
- B92% (22)
- D4% (1)
Why each option
The stats command with sum() and the 'by' clause is the correct Splunk SPL syntax for aggregating a numeric field grouped by another field such as host.
'|sum bytes by host' is invalid SPL because sum() must appear as an argument inside the stats command, not as a standalone piped command.
The syntax '| stats sum(categoryID) by host' correctly uses the stats command with the sum() aggregate function and the 'by' grouping clause to calculate the total categoryID value for each distinct host in the results. This follows the required SPL pattern where aggregate functions must be arguments inside stats.
'|sum(bytes) by host' is also invalid for the same reason - sum() requires the stats command; piping directly to sum() without stats is not supported SPL syntax.
'|stats sum by host' is invalid because the sum function requires a field argument in parentheses (e.g., sum(fieldname)) and cannot be used without specifying which field to sum.
Concept tested: Splunk stats sum function with by clause grouping
Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats
Topics
Community Discussion
No community discussion yet for this question.