Use the Chart Command SPLK-1002 Practice Questions (Page 3)

Questions 11–12

1. 11expert · hard

   A financial analyst needs to create a chart showing the total sales amount per region, but only for regions that have at least 100 sales transactions. The fields are `region`, `amount`, and each event is a sale. Which search correctly filters the results before applying the chart command?

   • Aindex=sales | chart sum(amount) by region | where sum(amount) >= 100
   • Bindex=sales | eventstats count as cnt by region | where cnt >= 100 | chart sum(amount) by region
   • Cindex=sales | chart sum(amount) by region | where count >= 100
   • Dindex=sales | stats count as cnt by region | where cnt >= 100 | chart sum(amount) by region
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What does the 'by' clause in the chart command do?

   • AIt groups data by the specified field, creating a separate column for each value.
   • BIt filters events to only those matching the specified field value.
   • CIt sorts the results by the specified field in ascending order.
   • DIt renames the output field to the specified name.
   Reveal Solution Discussion Select an answer first