Splunk Core Certified User — Question 88

Select the answer that displays the accurate placing of the pipe in the following search string: index=security sourcetype=access_* status=200 stats count by price

Answer options

• A. index=security sourcetype=access_* status=200 stats | count by price
• B. index=security sourcetype=access_* status=200 | stats count by price
• C. index=security sourcetype=access_* status=200 | stats count | by price
• D. index=security sourcetype=access_* | status=200 | stats count by price

Correct answer: B

Explanation

Option B is correct because it correctly uses the pipe to separate the search criteria from the stats command, allowing for the counting of results based on the specified conditions. Options A and C incorrectly place the pipe, while option D misplaces the pipe before the status filter, which disrupts the intended search flow.