SPLK-1002 · Question #96
What other syntax will produce exactly the same results as | chart count over vendor_action by user?
The correct answer is A. | chart count by vendor_action, user. In Splunk's chart command, 'over' specifies the x-axis field and 'by' specifies the split-by field. Using 'by' with two comma-separated fields achieves the same result.
Question
What other syntax will produce exactly the same results as | chart count over vendor_action by user?
Options
- A| chart count by vendor_action, user
- B| chart count over vendor_action, user
- C| chart count by vendor_action over user
- D| chart count over user by vendor_action
How the community answered
(20 responses)- A85% (17)
- B5% (1)
- C10% (2)
Why each option
In Splunk's chart command, 'over' specifies the x-axis field and 'by' specifies the split-by field. Using 'by' with two comma-separated fields achieves the same result.
The chart command treats the first field after 'by' as the x-axis and the second as the split-by series when two fields are listed. So 'chart count by vendor_action, user' is functionally identical to 'chart count over vendor_action by user' - vendor_action becomes the x-axis and user becomes the series.
'over' only accepts a single field argument; listing two fields after 'over' is invalid syntax.
This reverses the syntax - 'by vendor_action over user' is not valid Splunk chart syntax.
This swaps the roles: user would become the x-axis and vendor_action the split-by series, producing a different chart layout.
Concept tested: Splunk chart command over/by syntax equivalence
Source: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Chart
Topics
Community Discussion
No community discussion yet for this question.