What other syntax will produce exactly the same results as | chart count over vendor_action by user?
What other syntax will produce exactly the same results as | chart count over vendor_action by user?
The syntax '| chart count by vendor_action, user' will produce exactly the same results as '| chart count over vendor_action by user'. Both expressions will generate a chart counting the events grouped by 'vendor_action' and then 'user'. 'By' indicates grouping fields in sequence, which matches the intended operation specified.
A is the correct ans
A is the correct answer it will produce exactly the same chart
answer A
Equivalent expressions: by <field>, <field2> over <field> by <field2>
A is correct, reference F2 page 52
A is the correct answer Chart syntax is: over = [row-split] by = [column-split] By default, the first field name after the chart command is the [row-split] and the second is [column-split], so B would be the same as the example in the question https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Chart
A is correct, "over" is used for time-based aggregation, while "by" is used for field-based aggregation.
A is correct
A is correct
I think B is correct
B it's not possible