Splunk Core Certified User SPLK-1001 Question # 2 Topic 1 Discussion

Splunk Core Certified User SPLK-1001 Question # 2 Topic 1 Discussion

SPLK-1001 Exam Topic 1 Question 2 Discussion:
Question #: 2
Topic #: 1

When using the top command in the following search, which of the following will be true about the results?

index="main" sourcetype="access_*" action="purchase" | top 3 statusCode by user showperc=f countfield=status_code_count


A.

The search will fail. The proper top command format is top limit=3 instead of top 3.


B.

The top three most common values in statusCode will be displayed for each user.


C.

Only the top three overall most common values in statusCode will be displayed.


D.

The percentage field will be displayed in the results.


Get Premium SPLK-1001 Questions

Contribute your Thoughts:


Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.